Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240419-en
  • resource tags

    arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    30-05-2024 10:02

General

  • Target

    725f4b70b72fce7fb99c8bf5a064a03413ad7bcc1bfeb2bd2632462860459cc3.exe

  • Size

    1.8MB

  • MD5

    aec0f8dbe345cb17b5d95143cf886645

  • SHA1

    a30a8fb775010fd0c4ed19887b35e65d9475ec2b

  • SHA256

    725f4b70b72fce7fb99c8bf5a064a03413ad7bcc1bfeb2bd2632462860459cc3

  • SHA512

    966eed4f78a6ffab0a41a4aeefee4f06056b647028745c39ec47d97bb399b2a5390d1d5d093baf5dcdef95aac6124c7b9a31df705bc2260e7e8ac9b6a732c245

  • SSDEEP

    49152:QD6ipC5ihUxojZQVR+aS59/YOuSwLjbRm:Q+ipq0WSQp7

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

C2

http://147.45.47.155

Attributes
  • install_dir

    9217037dc9

  • install_file

    explortu.exe

  • strings_key

    8e894a8a4a3d0da8924003a561cfb244

  • url_paths

    /ku4Nor9/index.php

rc4.plain

Extracted

Family

amadey

Version

4.21

Botnet

49e482

C2

http://147.45.47.70

Attributes
  • install_dir

    1b29d73536

  • install_file

    axplont.exe

  • strings_key

    4d31dd1a190d9879c21fac6d87dc0043

  • url_paths

    /tr8nomy/index.php

rc4.plain

Extracted

Family

redline

Botnet

@LOGSCLOUDYT_BOT

C2

185.172.128.33:8970

Extracted

Family

redline

Botnet

1

C2

185.215.113.67:40960

Extracted

Family

stealc

Botnet

zzvv

C2

http://23.88.106.134

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

risepro

C2

147.45.47.126:58709

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies firewall policy service 2 TTPs 1 IoCs
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 4 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Stealc

    Stealc is an infostealer written in C++.

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 3 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 22 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 26 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 7 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Windows security modification 2 TTPs 4 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Drops Chrome extension 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 35 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\725f4b70b72fce7fb99c8bf5a064a03413ad7bcc1bfeb2bd2632462860459cc3.exe
    "C:\Users\Admin\AppData\Local\Temp\725f4b70b72fce7fb99c8bf5a064a03413ad7bcc1bfeb2bd2632462860459cc3.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3104
    • C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
      "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1804
      • C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
        "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
        3⤵
          PID:4576
        • C:\Users\Admin\1000004002\fbee1487e7.exe
          "C:\Users\Admin\1000004002\fbee1487e7.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1544
          • C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
            "C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3060
            • C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
              "C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:912
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                6⤵
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:740
                • C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
                  "C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4008
                • C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
                  "C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4064
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
                  7⤵
                    PID:1544
                    • C:\Windows\SysWOW64\choice.exe
                      choice /C Y /N /D Y /T 3
                      8⤵
                        PID:4772
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 272
                    6⤵
                    • Program crash
                    PID:4160
                • C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe"
                  5⤵
                  • Executes dropped EXE
                  • Modifies system certificate store
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2956
                • C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:3892
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    6⤵
                      PID:1792
                  • C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of WriteProcessMemory
                    PID:652
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      6⤵
                        PID:2992
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 272
                        6⤵
                        • Program crash
                        PID:3920
                    • C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe"
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of WriteProcessMemory
                      PID:1848
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        6⤵
                          PID:2420
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          6⤵
                          • Checks processor information in registry
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2592
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" & del "C:\ProgramData\*.dll"" & exit
                            7⤵
                              PID:1372
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout /t 5
                                8⤵
                                • Delays execution with timeout.exe
                                PID:4764
                        • C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe"
                          5⤵
                          • UAC bypass
                          • Windows security bypass
                          • Executes dropped EXE
                          • Windows security modification
                          • Checks whether UAC is enabled
                          • Suspicious use of SetThreadContext
                          • Suspicious use of AdjustPrivilegeToken
                          • System policy modification
                          PID:920
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe" -Force
                            6⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:872
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                            6⤵
                              PID:5060
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                              6⤵
                                PID:4784
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
                                6⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:436
                                • C:\Users\Admin\Pictures\AQHiLlejCnRpVqqlDdCfLTay.exe
                                  "C:\Users\Admin\Pictures\AQHiLlejCnRpVqqlDdCfLTay.exe" /s
                                  7⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Writes to the Master Boot Record (MBR)
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4364
                                • C:\Users\Admin\Pictures\mKjxiCxTarJ1uPwZAqioGqAe.exe
                                  "C:\Users\Admin\Pictures\mKjxiCxTarJ1uPwZAqioGqAe.exe"
                                  7⤵
                                  • Modifies firewall policy service
                                  • Windows security bypass
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Windows security modification
                                  • Checks whether UAC is enabled
                                  • Drops file in System32 directory
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  PID:2992
                                • C:\Users\Admin\Pictures\hvIb60LASstRQG15S1oYzPJN.exe
                                  "C:\Users\Admin\Pictures\hvIb60LASstRQG15S1oYzPJN.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  PID:3932
                                • C:\Users\Admin\Pictures\2UeTnPnb9TDSiocRrxW7avoc.exe
                                  "C:\Users\Admin\Pictures\2UeTnPnb9TDSiocRrxW7avoc.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  PID:5016
                                  • C:\Users\Admin\AppData\Local\Temp\7zS4561.tmp\Install.exe
                                    .\Install.exe
                                    8⤵
                                    • Executes dropped EXE
                                    PID:1444
                                    • C:\Users\Admin\AppData\Local\Temp\7zS4958.tmp\Install.exe
                                      .\Install.exe /NQHxdidUQs "385118" /S
                                      9⤵
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Enumerates system info in registry
                                      PID:2708
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                        10⤵
                                          PID:1076
                                          • C:\Windows\SysWOW64\forfiles.exe
                                            forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                            11⤵
                                              PID:1972
                                              • C:\Windows\SysWOW64\cmd.exe
                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                12⤵
                                                  PID:4664
                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                    13⤵
                                                      PID:2888
                                                • C:\Windows\SysWOW64\forfiles.exe
                                                  forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                  11⤵
                                                    PID:4624
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                      12⤵
                                                        PID:4960
                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                          13⤵
                                                            PID:1372
                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                        11⤵
                                                          PID:920
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                            12⤵
                                                              PID:3720
                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                13⤵
                                                                  PID:728
                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                              11⤵
                                                                PID:1544
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                  12⤵
                                                                    PID:4656
                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                      13⤵
                                                                        PID:4380
                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                    11⤵
                                                                      PID:2840
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                        12⤵
                                                                          PID:2740
                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                            13⤵
                                                                            • Command and Scripting Interpreter: PowerShell
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2664
                                                                            • C:\Windows\SysWOW64\gpupdate.exe
                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                              14⤵
                                                                                PID:4008
                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                                        10⤵
                                                                          PID:2324
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                            11⤵
                                                                              PID:4824
                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                12⤵
                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:3208
                                                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                  "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                  13⤵
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:2376
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks /CREATE /TN "bqGGCwwWIommTRgeuN" /SC once /ST 10:04:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS4958.tmp\Install.exe\" 1g /aFIdidAwJV 385118 /S" /V1 /F
                                                                            10⤵
                                                                            • Drops file in Windows directory
                                                                            • Creates scheduled task(s)
                                                                            PID:4808
                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                            "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bqGGCwwWIommTRgeuN"
                                                                            10⤵
                                                                              PID:2408
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                /C schtasks /run /I /tn bqGGCwwWIommTRgeuN
                                                                                11⤵
                                                                                  PID:1644
                                                                                  • \??\c:\windows\SysWOW64\schtasks.exe
                                                                                    schtasks /run /I /tn bqGGCwwWIommTRgeuN
                                                                                    12⤵
                                                                                      PID:1744
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 1012
                                                                                  10⤵
                                                                                  • Program crash
                                                                                  PID:2544
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
                                                                          6⤵
                                                                            PID:1552
                                                                        • C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe"
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          PID:3064
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Newoff.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe" /F
                                                                            6⤵
                                                                            • Creates scheduled task(s)
                                                                            PID:1696
                                                                    • C:\Users\Admin\AppData\Local\Temp\1000005001\3b36149fb2.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\1000005001\3b36149fb2.exe"
                                                                      3⤵
                                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                      • Checks BIOS information in registry
                                                                      • Executes dropped EXE
                                                                      • Identifies Wine through registry keys
                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:408
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 912 -ip 912
                                                                  1⤵
                                                                    PID:2400
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 652 -ip 652
                                                                    1⤵
                                                                      PID:2028
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                      1⤵
                                                                        PID:1696
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                        1⤵
                                                                          PID:364
                                                                        • C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
                                                                          1⤵
                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                          • Checks BIOS information in registry
                                                                          • Executes dropped EXE
                                                                          • Identifies Wine through registry keys
                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:1104
                                                                        • C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
                                                                          1⤵
                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                          • Checks BIOS information in registry
                                                                          • Executes dropped EXE
                                                                          • Identifies Wine through registry keys
                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:4032
                                                                        • C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
                                                                          1⤵
                                                                          • Executes dropped EXE
                                                                          PID:3920
                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS4958.tmp\Install.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\7zS4958.tmp\Install.exe 1g /aFIdidAwJV 385118 /S
                                                                          1⤵
                                                                          • Executes dropped EXE
                                                                          • Modifies data under HKEY_USERS
                                                                          PID:4652
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                            2⤵
                                                                              PID:2876
                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                3⤵
                                                                                  PID:3312
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                    4⤵
                                                                                      PID:1556
                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                        5⤵
                                                                                          PID:560
                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                      3⤵
                                                                                        PID:4820
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                          4⤵
                                                                                            PID:2536
                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                              5⤵
                                                                                                PID:4584
                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                            forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                            3⤵
                                                                                              PID:3940
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                4⤵
                                                                                                  PID:1104
                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                    5⤵
                                                                                                      PID:1764
                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                  forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                  3⤵
                                                                                                    PID:4624
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                      4⤵
                                                                                                        PID:1624
                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                          5⤵
                                                                                                            PID:4496
                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                        3⤵
                                                                                                          PID:3280
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                            4⤵
                                                                                                              PID:3856
                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                5⤵
                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                • Drops file in System32 directory
                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:3208
                                                                                                                • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                  6⤵
                                                                                                                    PID:5092
                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                                            2⤵
                                                                                                            • Drops file in System32 directory
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:2408
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                              3⤵
                                                                                                                PID:1496
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                  4⤵
                                                                                                                    PID:4188
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                                  3⤵
                                                                                                                    PID:4772
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                                    3⤵
                                                                                                                      PID:2980
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                                      3⤵
                                                                                                                        PID:2784
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                                        3⤵
                                                                                                                          PID:3780
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                                          3⤵
                                                                                                                            PID:4220
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                            3⤵
                                                                                                                              PID:560
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                                              3⤵
                                                                                                                                PID:1168
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                                                                3⤵
                                                                                                                                  PID:2236
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:4976
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                                                    3⤵
                                                                                                                                      PID:5004
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                                                      3⤵
                                                                                                                                        PID:5000
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                                                        3⤵
                                                                                                                                          PID:1316
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                                          3⤵
                                                                                                                                            PID:692
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:4832
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                                              3⤵
                                                                                                                                                PID:3856
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                3⤵
                                                                                                                                                  PID:1372
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                  3⤵
                                                                                                                                                    PID:228
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                    3⤵
                                                                                                                                                      PID:2500
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1968
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1284
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                                                          3⤵
                                                                                                                                                            PID:4112
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                                                            3⤵
                                                                                                                                                              PID:4008
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                                                              3⤵
                                                                                                                                                                PID:3412
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:2192
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:1704
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:4488
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:3312
                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JipyTrDkU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JipyTrDkU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YLgKyOFzWxOqC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YLgKyOFzWxOqC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\krdeMCnRKomDOvwVunR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\krdeMCnRKomDOvwVunR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nFLFFjqrQPUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nFLFFjqrQPUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tegRANPZONsU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tegRANPZONsU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fcblnlcRRSrBhAVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fcblnlcRRSrBhAVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ZmzskowerwXEonlG\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ZmzskowerwXEonlG\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                      PID:4164
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:560
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:1168
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:2236
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:4976
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:5004
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:5000
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:1316
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:692
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:4832
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:3856
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:1372
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fcblnlcRRSrBhAVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:228
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fcblnlcRRSrBhAVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:2500
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:1968
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:1284
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:4112
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:4008
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:3412
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:2192
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ZmzskowerwXEonlG /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:1704
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ZmzskowerwXEonlG /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:4488
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TN "gXtGDpGHO" /SC once /ST 09:51:48 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:4584
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /run /I /tn "gXtGDpGHO"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:388
                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                  schtasks /DELETE /F /TN "gXtGDpGHO"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:4772
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /CREATE /TN "WKALCIrwIEiqhKBsn" /SC once /ST 01:57:18 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\whtBcZm.exe\" y7 /kUJFdidhZ 385118 /S" /V1 /F
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                    PID:4624
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /run /I /tn "WKALCIrwIEiqhKBsn"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:1556
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 864
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                      PID:2376
                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:1644
                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                      PID:1344
                                                                                                                                                                                                                      • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                                        "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:5112
                                                                                                                                                                                                                      • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                        gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:3488
                                                                                                                                                                                                                        • C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\whtBcZm.exe
                                                                                                                                                                                                                          C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\whtBcZm.exe y7 /kUJFdidhZ 385118 /S
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Drops Chrome extension
                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                          PID:328
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:1852
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:4808
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                      PID:4388
                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                          PID:3992
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:3084
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:4384
                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                PID:968
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:4112
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                  PID:4064
                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                      PID:5100
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:1484
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                        PID:4868
                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                            PID:4696
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                        forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:2124
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                              PID:4024
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                PID:3288
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:1240
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                            schtasks /DELETE /F /TN "bqGGCwwWIommTRgeuN"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:4192
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:4488
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                  forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:2216
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:4412
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                          powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                          PID:3776
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                            PID:580
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\JipyTrDkU\dGiTFg.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "jiLwFdOzPPQiWLm" /V1 /F
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                                                                    PID:4772
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                    schtasks /CREATE /TN "jiLwFdOzPPQiWLm2" /F /xml "C:\Program Files (x86)\JipyTrDkU\jDeJsby.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                                                                    PID:3516
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                    schtasks /END /TN "jiLwFdOzPPQiWLm"
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:1764
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                      schtasks /DELETE /F /TN "jiLwFdOzPPQiWLm"
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:1972
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                        schtasks /CREATE /TN "EyAjTIEydjCaoB" /F /xml "C:\Program Files (x86)\tegRANPZONsU2\eRLnhWL.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                        PID:4624
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                        schtasks /CREATE /TN "nwujZhVsLEYxr2" /F /xml "C:\ProgramData\fcblnlcRRSrBhAVB\oVhVzig.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                        PID:4352
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                        schtasks /CREATE /TN "njgsfWmNUCIAXOmvm2" /F /xml "C:\Program Files (x86)\krdeMCnRKomDOvwVunR\GyJBgba.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                        PID:1968
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                        schtasks /CREATE /TN "ZXdYLGWImophNcyfuyr2" /F /xml "C:\Program Files (x86)\YLgKyOFzWxOqC\EatmtLZ.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                        PID:2612
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                        schtasks /CREATE /TN "QdCYtDviHOrgqJLgZ" /SC once /ST 00:12:21 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ZmzskowerwXEonlG\bNDPjrHb\NjznKdu.dll\",#1 /hdiddLO 385118" /V1 /F
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                        PID:724
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                        schtasks /run /I /tn "QdCYtDviHOrgqJLgZ"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:560
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                          schtasks /DELETE /F /TN "WKALCIrwIEiqhKBsn"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:3764
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 328 -s 2396
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                            PID:1848
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4652 -ip 4652
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:248
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                            PID:2664
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                            PID:2068
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:560
                                                                                                                                                                                                                                                                          • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                                                                                            C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZmzskowerwXEonlG\bNDPjrHb\NjznKdu.dll",#1 /hdiddLO 385118
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:3912
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZmzskowerwXEonlG\bNDPjrHb\NjznKdu.dll",#1 /hdiddLO 385118
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                • Blocklisted process makes network request
                                                                                                                                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                PID:4648
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                  schtasks /DELETE /F /TN "QdCYtDviHOrgqJLgZ"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:5040
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2708 -ip 2708
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:1364
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 328 -ip 328
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:4436

                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                  MITRE ATT&CK Matrix ATT&CK v13

                                                                                                                                                                                                                                                                                  Execution

                                                                                                                                                                                                                                                                                  Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1059

                                                                                                                                                                                                                                                                                  PowerShell

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1059.001

                                                                                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                                                                                  Persistence

                                                                                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                                                                                  Pre-OS Boot

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1542

                                                                                                                                                                                                                                                                                  Bootkit

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1542.003

                                                                                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                                                                                  Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1548

                                                                                                                                                                                                                                                                                  Bypass User Account Control

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1548.002

                                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                                                                                                                  Modify Registry

                                                                                                                                                                                                                                                                                  7
                                                                                                                                                                                                                                                                                  T1112

                                                                                                                                                                                                                                                                                  Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1548

                                                                                                                                                                                                                                                                                  Bypass User Account Control

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1548.002

                                                                                                                                                                                                                                                                                  Impair Defenses

                                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                                  T1562

                                                                                                                                                                                                                                                                                  Disable or Modify Tools

                                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                                  T1562.001

                                                                                                                                                                                                                                                                                  Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                  T1497

                                                                                                                                                                                                                                                                                  Pre-OS Boot

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1542

                                                                                                                                                                                                                                                                                  Bootkit

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1542.003

                                                                                                                                                                                                                                                                                  Subvert Trust Controls

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1553

                                                                                                                                                                                                                                                                                  Install Root Certificate

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1553.004

                                                                                                                                                                                                                                                                                  Credential Access

                                                                                                                                                                                                                                                                                  Unsecured Credentials

                                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                                  T1552

                                                                                                                                                                                                                                                                                  Credentials In Files

                                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                                  T1552.001

                                                                                                                                                                                                                                                                                  Discovery

                                                                                                                                                                                                                                                                                  Query Registry

                                                                                                                                                                                                                                                                                  6
                                                                                                                                                                                                                                                                                  T1012

                                                                                                                                                                                                                                                                                  Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                  T1497

                                                                                                                                                                                                                                                                                  System Information Discovery

                                                                                                                                                                                                                                                                                  5
                                                                                                                                                                                                                                                                                  T1082

                                                                                                                                                                                                                                                                                  Collection

                                                                                                                                                                                                                                                                                  Data from Local System

                                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                                  T1005

                                                                                                                                                                                                                                                                                  Command and Control

                                                                                                                                                                                                                                                                                  Web Service

                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                  T1102

                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\JipyTrDkU\jDeJsby.xml
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    16246e841805468ef708f5c4a972865e

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    f7950ace8811796e350c0b1110b22266dcc39c3e

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    806c8a13e115eede73977754ba9c874d7bc69bb390c98e35342dd60d66ebe2ba

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    78b1f2f140003b3b6ed46e83f09c01ad90b78f1a134ea8df4a44e4ed68402f6d373a27832133df1576b27f800b2694655d5baf720b56a3217291fb4de9f6a310

                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\YLgKyOFzWxOqC\EatmtLZ.xml
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    d0b75b798223681c617d04a1dfa2c5fb

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    6baecd3106798129bded5751da26e7d9b9daaa93

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    4e1b124180859f298df120a926c658021311852f45763edb51ae3783fa9b258e

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    a6ff9189eb51d0f40e79bc4067d40e2231f37a43839c5875d355563002defc78f9362c25f7325627d20d59f5e07903b5ec46557974ab0a8a0cab01eaf64e25e3

                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\krdeMCnRKomDOvwVunR\GyJBgba.xml
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    8c6954c65fb0cbe1a60ffd126dbeb796

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    231b03b263cf8b3fb0c64c55818d861797d8d43a

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    fa3b59754eaa23f20baa4f1ac887c2f4f3f30aec3a50fcb18bd3c086512013c5

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    502a64bf022c7cc035d55518222824553f049a9461895e9645c7c19c661e14ee8ae198ec93d10f2e0793868067c5544c20c16aa28df501105bde93fbfe71b0b1

                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\tegRANPZONsU2\eRLnhWL.xml
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    54781ba174d3bfffd12734c973053784

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    d1fc257d5cfb4ce34fc98ccb3dd897ab9c7f4c48

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    dc5ec980f303fec89df08da0ce92e35fab6cb5d89c19ab07e9cfad7c7af8c5af

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    9306fc1c95ca90a8ae39baa1a45ace9128728684e977ca17d29b953dceccacf113b0293c978e5d51eb2d87113db42d576dd8b5bccddd2683f0f80e93775df224

                                                                                                                                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2.5MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    6aa6ab61bdf5328333afef779cf2004e

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    de82192ee8c961dab397fb1fbd424afc2a7ce04c

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    f6c90f0afd8a8e8acb0c4e6df86e2a80eabfa27d5ebdfd7a96da45321b730b5e

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    fdf43465dcf0e67ad181f8abfcb3ed20180aacc5496f3bf163ab35267d5aabf0ecb0c8d68a434c278a14efb9a4c411fb4853a97f94f4434b9c0565516120c575

                                                                                                                                                                                                                                                                                  • C:\ProgramData\fcblnlcRRSrBhAVB\oVhVzig.xml
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    f0179a10a138b643b12a309ed72c6ac5

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    8517d705418ae02b16b30d081ed66a94c719ed7c

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    24771094ddd526931d63c31980eb004d6926e49aa7860ac8bc976e7759af4822

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    59f5c4be617fd589512443e161b925618d640206a382f31ac5adbe887f090dfd64c200f13dd372007b04750df81096a4ee4f0d6717ccbf5a9839a24acd2898dd

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\1000004002\fbee1487e7.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.8MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    c8b8b75832a3acf6990ce56b6004d96a

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    4ba4b21d90c069f183c9db8d8011eab8273c0558

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    f9e7fd86bcb4805538be84f8f156a8e11f229df5050399fb63874cb518d0e26e

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    a31190f22a7a8fadb96bbb16fae9fea2040ff72bdce7b838bdb5d99dbeaacaa52b5607afa11f8a09eac573c24c03aa6302e2938f9d419c13918887a987c3af75

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    187B

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    136B

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    150B

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    35KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    313ceec3e75ba2389d1f61520868be53

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    545774fa0cde54c259a4b05f614865e41ce66f91

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    e33bb5a52e38d9ba49faed74b005902c9229368596dad5e0387b2713c8892f79

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    17bf0e3b11e67b5d9775e721172063c87abad836340e6c5ca3120e49c81d1c8bc72feecdeb8485bfc32cbdadce61688e053d133f82043741fa5b05f80e4b5810

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    627073ee3ca9676911bee35548eff2b8

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    faa2dd409bb88491b6c57728dbf8a673

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    6095f074030e7599cb1f9c251c62e2c0d1fb7418

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    955d02ee998eae94048f3a1b33c8eedc73276ef0a179efb1cebc970d9af0df09

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    0ab69299400998bc05fe7074b2c9b01162db9343deab22b502a26c47a054d2ca42918908fcc77a8cc5d275c17635508d546c3f65d857f37a7331ec9c32a766ce

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    151B

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    944B

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    e3840d9bcedfe7017e49ee5d05bd1c46

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    272620fb2605bd196df471d62db4b2d280a363c6

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    3ac83e70415b9701ee71a4560232d7998e00c3db020fde669eb01b8821d2746f

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    76adc88ab3930acc6b8b7668e2de797b8c00edcfc41660ee4485259c72a8adf162db62c2621ead5a9950f12bfe8a76ccab79d02fda11860afb0e217812cac376

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    15KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    a21677159154cd4ec1d0fe2a8f351e08

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    24ceb69724ac51e1ab26f11314035223a7866e1e

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    23d1c4462103d309d2388bc232f52a8d4b9844b88191dc5cc594e64205727804

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    b5d7b626b8c3f4700f94bb163fadb6618e297a32538ad52ac44e85ac0ee83bf13491105a9d507c8babe5fbe6b9ef9d693bc4c3ed4c10d8def84c2ff8a4c91816

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    11KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    2c200d1f6da139e2d4a7e856e132e706

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    03af85b8f204015f109a15fc65cad194d2e5a78c

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    b1a97eddd942fae544f3d1df8177c2f40c957196e5a209847ea7e963b40c7760

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    270798d975b55ca925351a0be31f2bd6ddab8614c526c2dc06b0a076f1fe6378596dc3a55a4770dece12c99968cbd58ddd9c4bbb9ac0db1c1724c2d698efb935

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\favicon.png
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    5.9MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    1603865df23efcd1dc421a48f090b2d5

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    29c835478c413295787656da1201a3bd08582267

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    fc48da13fe7501b9a08daced7a7fadc6914a36c6c12461a73d2170d748be5712

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    e9bca0319aa1cacdd86a3b5b5904cd508a245e64399acf335299b298feec130985b68ad3456b177aa466284c6239e952aa15ed0e6545ae6ad72848d3ea6405b1

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\[email protected]
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    656B

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    184a117024f3789681894c67b36ce990

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    c5b687db3b27ef04ad2b2cbc9f4e523cb7f6ba7e

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    b10d5fef165fc89e61cd16e02eac1b90b8f94ef95218bdd4b678cd0d5c8a925e

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    354d3bbc1329cbbe30d22f0cf95564e44acc68d6fe91e2beb4584a473d320faf4c092de9db7f1f93cf0b235703fc8de913883985c7d5db6b596244771a1edaf7

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    830B

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    e6edb41c03bce3f822020878bde4e246

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    03198ad7bbfbdd50dd66ab4bed13ad230b66e4d9

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    9fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    2d71b7d50212f980e82562af95598c430aa0875f7a9d9cc670ba2cb1f63057fb26fd747a99cb4ca08f2355d002daa79bda2236b3ad9e37a3cfef32ae5420e2a1

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2.1MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    208bd37e8ead92ed1b933239fb3c7079

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    941191eed14fce000cfedbae9acfcb8761eb3492

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    e1fd277ffc74d67554adce94366e6fa5ebc81f8c4999634bcc3396164ba38494

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    a9c3c32573a16b7ca71a12af6e8c8e88502b66bae2465a82dd921fbc6e0c833b9b1c2d436963df189dd9d68568e1be9128826a2e59f1d5fe066b637d2d866715

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000005001\3b36149fb2.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2.3MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    4c0ac01a93ed574215607e55e31cbdcd

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    e313d76478aae68cf5829c90feea89837c6b4185

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    cb052f0f705338689859907825439468244fd332936546a93c6414e35b769369

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    c13e254c0cadce21d4d4137fc2815b039fafa1f655e4511ebf47f3d094b47225682f36ab48a4f3c15e7b50b45b646a156b6c3a98effdc562b91c7902590b2a1c

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    84bf36993bdd61d216e83fe391fcc7fd

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    e023212e847a54328aaea05fbe41eb4828855ce6

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    8e6d8b5a004c8f21bee1bbe4213c6d78cf80e439b38f587e963e9bb4569aaffa

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    bb3241949618ad2d39057e085e150f43b4d41d74efc4658d9c27f8c0ec80420191517a2c0b6b7e225c4e50e02cd031cdfd178e05b9a869847a3c27b210d09caf

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    518KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    c4ffab152141150528716daa608d5b92

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    a48d3aecc0e986b6c4369b9d4cfffb08b53aed89

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    c28de1802bdbcf51c88cd1a4ac5c1decb0558fa213d83833cf5dbd990b9ae475

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    a225e98f2bc27e2add9d34bd850e0e66a27bd1db757c979639a636a6efe412e638025c6e235c36188a24c9af2bde4b17d1dbaa0707dce11411402cd5de8024e9

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.2MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    0b7e08a8268a6d413a322ff62d389bf9

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    e04b849cc01779fe256744ad31562aca833a82c1

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    d23a10b3ff0c565ea8ee7f54bcded0582e1e621ebad69d4523d6746f6d8e0e65

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    3d226673e30bbbc27e0a5a6c64bf81eca475c697486b20141df7975bef97901d4865b88f41937f5e3dd00b437f24f91493f80cb69aa366b7a49cd17b26197ba4

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    778KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    05b11e7b711b4aaa512029ffcb529b5a

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    a8074cf8a13f21617632951e008cdfdace73bb83

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    2aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    dde7b561ffb3b9fe71827be9313cd3b83900c3ce76b053d028e84223fba1b06035437b3860a74de7dc2f5d40f0b90bd7d60139701d752c803eb08f362a5d57ff

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    579KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    a991da123f34074f2ee8ea0d798990f9

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    3988195503348626e8f9185747a216c8e7839130

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    1f958cacb820833ea8b5ac2d9ca7f596625e688f8f6b6e3ab6f27aa3b25b8c9e5b57e1eed532a8d2519da6c1b41492eb8ac930fc25eaf2be2f344c2f32e81a49

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000030001\CoMachina.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    162B

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    1b7c22a214949975556626d7217e9a39

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    d01c97e2944166ed23e47e4a62ff471ab8fa031f

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    418KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    0099a99f5ffb3c3ae78af0084136fab3

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    0205a065728a9ec1133e8a372b1e3864df776e8c

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4561.tmp\Install.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    6.3MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    7d1dd60c4b8fb4167645f7093801b6d9

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    4ae1feb130e57f803ef00709419e6226b7c0e54d

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    1c62508e00e567d8f753734590a0a303acad2877681173cb4eed2e1a8409f3e9

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    7904bcaefe3d2f0e643f24a2e1eb6f0079e28d7df15f7be0fcd73ecc76680a9a677fe199d8a4d80d08144adbd4769d2a14eac2f933404aeeec05fe103429e872

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4958.tmp\Install.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    6.6MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    0550ef6afda33ea1c1a231b939ca9b07

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    f74897166553b218e3a0869502ed036f175be9cd

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    8462d8b0433559e9afc2cd5de7bffe38fc6b82e3da9e79bdd33a85ab79fafaeb

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    329fa4ba439852740683dfb60070116fc459785d8a936e59aa4e55affe4697d66c5db844d154b30ab41913342fd5d51760f329cf30dc039387d0929026219a2e

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.8MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    aec0f8dbe345cb17b5d95143cf886645

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    a30a8fb775010fd0c4ed19887b35e65d9475ec2b

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    725f4b70b72fce7fb99c8bf5a064a03413ad7bcc1bfeb2bd2632462860459cc3

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    966eed4f78a6ffab0a41a4aeefee4f06056b647028745c39ec47d97bb399b2a5390d1d5d093baf5dcdef95aac6124c7b9a31df705bc2260e7e8ac9b6a732c245

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TmpABD0.tmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hdehzil0.e2e.ps1
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    60B

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{9E860E57-FF66-434a-8042-2B4522B3B780}.tmp\360P2SP.dll
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    824KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    fc1796add9491ee757e74e65cedd6ae7

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    603e87ab8cb45f62ecc7a9ef52d5dedd261ea812

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1474490143-3221292397-4168103503-1000\76b53b3ec448f7ccdda2063b15d2bfc3_a3a1c297-edb6-403a-b657-0094dc11d6d9
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    3af578eaf8b1baab0511e11d45014601

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    889a8ec55bc4319a1cf00d08e3d9610563c7e258

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    60bc49484a5546f7e4625496fd984f89c5df0738587bfb66995b627cd8f63826

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    b58dab0abf879d1a9cddeee426a73b022029c07c9a29ddcb82aade99926a58677442789ec7f14cff55fa157b4651cc0de60626bcce304e83512805d3d0d379f3

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pz5zwzp5.default-release\prefs.js
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    8a74578f56577e13d5aa58eb33d10ba9

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    a809dfe4e2ee5f22ed42bb734bfb1a126e5c924a

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    1af0730ada8b6be0266387e92710aa376954409a7c1532fe82e212536d4d8690

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    e6087cd04ca71bb20ee9371604d25f739b4dfd793ed8138da9a7d5313d14ecad0a230a3fa5c8976a4db39e406191df7aa1f15ce61eb313b0209dd3700689f5d2

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    408KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    816df4ac8c796b73a28159a0b17369b6

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    db8bbb6f73fab9875de4aaa489c03665d2611558

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    7843255bc50ddda8c651f51347313daf07e53a745d39cc61d708c6e7d79b3647

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    7dd155346acf611ffaf6399408f6409146fd724d7d382c7e143e3921e3d109563c314a0367a378b0965e427470f36bf6d70e1586d695a266f34aebd789965285

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    15a7cae61788e4718d3c33abb7be6436

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    62dac3a5d50c93c51f2ab4a5ebf78837dc7d3a9f

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    bed71147aa297d95d2e2c67352fc06f7f631af3b7871ea148638ae66fc41e200

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    5b3e3028523e95452be169bdfb966cd03ea5dbe34b7b98cf7482ca91b8317a0f4de224751d5a530ec23e72cbd6cc8e414d2d3726fefee9c30feab69dc348fa45

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    e961cbcc287c5fb557574ccff743899b

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    6d8cbe65c2813c09dd135f73d86e06b1be1c0935

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    80d07fde1eaacdeff45b0da741cf91eeff95fe72f53289cbe1850efc63ebae30

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    287fabe4080478ceb2b5eb8c2f09c8c61f1b3915624eb92dc24e333a219f283f8de5d2c869281d457845d83a2bb117ea4f3fafba58226c419b62ebae17976409

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\2UeTnPnb9TDSiocRrxW7avoc.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    7.3MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    08063da816c5db77ce64807c4ec2f7e8

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    61ded712f36458ba6ffcec37edbf65d5927d2d92

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    dd08b1356c9b9bffe1ae9c254d28411890204e5b8fe1f9b9af0a7a3e5b6ed61e

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    df74cef767efde4711af6e40ef82801d91c4f1b5805fb0411235272a62fd08204d39153d4ae2056880d9d3ceaaae9c8e87254ea57d35a83bf501ac5be721c5f0

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\AQHiLlejCnRpVqqlDdCfLTay.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.5MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    cd4acedefa9ab5c7dccac667f91cef13

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    bff5ce910f75aeae37583a63828a00ae5f02c4e7

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    06fae66da503eb1b9b4fbe63a5bb98c519a43999060029c35fe289e60b1cb126a6278c67ce90f02e05b893fcaea6d54f9deb65bc6da82561487a7754f50c93d1

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\LhiK9NVnyw525agefHrPDJDI.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    7KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    77f762f953163d7639dff697104e1470

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\hvIb60LASstRQG15S1oYzPJN.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    12.3MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    acadbe83c09a7a9b8213a662eda12e93

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    26a6e55076bc0602ff9060ac529528f3fc631986

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    42dd6aeee394e298646701ebe1fd611186ea4ee8c7e6383913db121444635944

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    a7ad3777e4a5ae9dd8dd09cff3a3ab498c6d2dc5b922407c48936225cb0c91430f75114f46b0a7b39046dc45c26221e199d33ff0bce105e05e903eef7fbdcd9f

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\mKjxiCxTarJ1uPwZAqioGqAe.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    6.4MB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    0e0938f8a7266056305bfedda7e1e78a

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    2b4aa419957936fa6c6a2afbadb6bc30c1c4895d

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    b542adb1e853812925a1b5a1d1feac30125f05a9d7d0b1adce9ef4c6354c1066

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    4c430686f61843fc17c67fa8e78357f576620937137b7153bd2da4cc4f73a104130c221f24fb8060a767eac178bb6b319763b964eeffaa339b73cce444286490

                                                                                                                                                                                                                                                                                  • C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    db0c47ecd0100d932cddfcfdc1771bb9

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    aebae048bcb40790ae256a9ae1bdceb341fc1890

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    edb03ca496c56fcdcc3c10e77a5b50d9023e497dee6f2c1f0e360e279cd44a01

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    8ce2128d11da81251914b14a1bbb00d0098ce99d5218846261f438f98b70d20acd5a36aa7f20726970110ab2a3c7c6a411d60c162dae46c58890d10982e2700b

                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    e080d58e6387c9fd87434a502e1a902e

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    ae76ce6a2a39d79226c343cfe4745d48c7c1a91a

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    6fc482e46f6843f31d770708aa936de4cc32fec8141154f325438994380ff425

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    6c112200ef09e724f2b8ab7689a629a09d74db2dcb4dd83157dd048cbe74a7ce5d139188257efc79a137ffebde0e3b61e0e147df789508675fedfd11fcad9ede

                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    15KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    332c46c638f2ef2f39ff254b0824679f

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    dc429db33f24a17ca0b5816243e3092c401ed24c

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    99457ddac5cd3af3d879a8b1eae801e660fcc7ba960ce0707c6fc74ce8832196

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    733d37ddb338f9cce989d1dad19c9f2fb9f677d5acfe2d68029b68a38dd89bb5eb5a6ca74f35ed5e52b8a397eb32962376d043d1afac838f5519758cb5adf600

                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    11KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    d790c54fd2f27d1f8061594519b80aa3

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    d7076d12e1037d72c7cdaae2386bcc35bb2dde60

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    ef73e3d8eded8ca3c8463422df4e0558a411ad00be20aaa6abe3f347073b43d4

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    1b5f208a4b4c914e57b12c7dc17c9818d59bb493fb385c63a0b5cd000b1e5783e9f79338e83077a2b5cd05cc59eae1792cbcb563550cf34b48fd1915026fc00b

                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    11KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    d0ff630864a5441efb85904f2c40c116

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    7600e69cc39754ca5fcc6f4a86445e005319aff4

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    31acf7198f1a5ec363b711f7575b4de55dde44f069e6a7ac745a75a6d0db53ac

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    fd635ed0e1bba68e73f6beb8e80692da012289d0765f717ff17bb8a7343082051e38f0f5bbdea968b0da1746ba0b0ba85d1d0adb49b2197089227cceb7e3eb8e

                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    15KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    38e398f9aa19708d23d0941fb59d2d40

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    2ba51e46f40a27c0e14be57fbdd0cf13b9b12760

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    1859a75ee33d9522d225a7a72aa8916c55d8095fba1c3a55fe1a17d4e472f06c

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    372ca163d2637adbd50bea119a8bdeba44659ef78369e69158e53026033fa4dcc50fe33eda8c046e23ab5eddc1412c2b1e58ae4fa3565688a880cb76538ca6bc

                                                                                                                                                                                                                                                                                  • C:\Windows\system32\GroupPolicy\Machine\Registry.pol
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    0a48000b0ebb8e94be299edc703328fe

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    02c746f931d1bc73303e8b0fa42eb5cb9bc9cc52

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    81d9b12cf4c7aeb97fff5d5616bd36e230c3cd69397f2ad1c962582f1072dd47

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    01aeeb4e8417c5784c069bcd7511edec7091274a9bd4e9137152d5e18b11ec7c242253983d1d8732dda72c82a9ca46f06696525a6235b41bea04ddd58fa1c0c1

                                                                                                                                                                                                                                                                                  • memory/328-579-0x0000000010000000-0x00000000105DF000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    5.9MB

                                                                                                                                                                                                                                                                                  • memory/328-589-0x0000000002840000-0x00000000028C5000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    532KB

                                                                                                                                                                                                                                                                                  • memory/408-557-0x0000000000300000-0x00000000008F1000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    5.9MB

                                                                                                                                                                                                                                                                                  • memory/408-499-0x0000000000300000-0x00000000008F1000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    5.9MB

                                                                                                                                                                                                                                                                                  • memory/408-320-0x0000000000300000-0x00000000008F1000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    5.9MB

                                                                                                                                                                                                                                                                                  • memory/408-561-0x0000000000300000-0x00000000008F1000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    5.9MB

                                                                                                                                                                                                                                                                                  • memory/408-428-0x0000000000300000-0x00000000008F1000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    5.9MB

                                                                                                                                                                                                                                                                                  • memory/408-166-0x0000000000300000-0x00000000008F1000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    5.9MB

                                                                                                                                                                                                                                                                                  • memory/408-416-0x0000000000300000-0x00000000008F1000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    5.9MB

                                                                                                                                                                                                                                                                                  • memory/408-457-0x0000000000300000-0x00000000008F1000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    5.9MB

                                                                                                                                                                                                                                                                                  • memory/436-307-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    32KB

                                                                                                                                                                                                                                                                                  • memory/652-216-0x0000000001550000-0x0000000001551000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/740-70-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                                                                                  • memory/872-304-0x000001BB7A390000-0x000001BB7A3B2000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                                                                                  • memory/912-71-0x0000000000B40000-0x0000000000B41000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/912-69-0x0000000000B40000-0x0000000000B41000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/920-260-0x00000234B5560000-0x00000234B559C000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    240KB

                                                                                                                                                                                                                                                                                  • memory/920-292-0x00000234B59A0000-0x00000234B59A6000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    24KB

                                                                                                                                                                                                                                                                                  • memory/920-293-0x00000234B7220000-0x00000234B727C000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    368KB

                                                                                                                                                                                                                                                                                  • memory/1104-419-0x00000000007A0000-0x0000000000C57000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/1104-424-0x00000000007A0000-0x0000000000C57000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/1544-50-0x0000000000FB0000-0x0000000001467000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/1544-39-0x0000000000FB0000-0x0000000001467000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/1792-198-0x0000000000400000-0x0000000000455000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    340KB

                                                                                                                                                                                                                                                                                  • memory/1792-196-0x0000000000400000-0x0000000000455000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    340KB

                                                                                                                                                                                                                                                                                  • memory/1804-496-0x00000000003A0000-0x0000000000852000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/1804-425-0x00000000003A0000-0x0000000000852000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/1804-321-0x00000000003A0000-0x0000000000852000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/1804-535-0x00000000003A0000-0x0000000000852000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/1804-238-0x00000000003A0000-0x0000000000852000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/1804-430-0x00000000003A0000-0x0000000000852000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/1804-319-0x00000000003A0000-0x0000000000852000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/1804-18-0x00000000003A0000-0x0000000000852000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/1804-19-0x00000000003A0000-0x0000000000852000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/1804-20-0x00000000003A0000-0x0000000000852000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/1804-560-0x00000000003A0000-0x0000000000852000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/1804-164-0x00000000003A0000-0x0000000000852000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/1804-21-0x00000000003A0000-0x0000000000852000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/1804-575-0x00000000003A0000-0x0000000000852000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/1804-414-0x00000000003A0000-0x0000000000852000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/1848-235-0x0000000000F40000-0x0000000000F41000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/2068-795-0x00000000003A0000-0x0000000000852000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/2068-970-0x00000000003A0000-0x0000000000852000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/2592-236-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2.2MB

                                                                                                                                                                                                                                                                                  • memory/2592-234-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    2.2MB

                                                                                                                                                                                                                                                                                  • memory/2664-473-0x0000000005A60000-0x0000000005A7E000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                                                                                  • memory/2664-459-0x0000000004600000-0x0000000004636000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    216KB

                                                                                                                                                                                                                                                                                  • memory/2664-477-0x00000000060B0000-0x00000000060D2000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                                                                                  • memory/2664-476-0x0000000005F70000-0x0000000005F8A000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    104KB

                                                                                                                                                                                                                                                                                  • memory/2664-475-0x0000000005FE0000-0x0000000006076000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    600KB

                                                                                                                                                                                                                                                                                  • memory/2664-474-0x0000000005AA0000-0x0000000005AEC000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                  • memory/2664-471-0x00000000055F0000-0x0000000005947000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                                                                                  • memory/2664-975-0x00000000007A0000-0x0000000000C57000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/2664-462-0x00000000054A0000-0x0000000005506000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    408KB

                                                                                                                                                                                                                                                                                  • memory/2664-461-0x0000000005400000-0x0000000005422000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                                                                                  • memory/2664-460-0x0000000004D70000-0x000000000539A000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    6.2MB

                                                                                                                                                                                                                                                                                  • memory/2664-794-0x00000000007A0000-0x0000000000C57000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/2708-480-0x0000000010000000-0x00000000105DF000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    5.9MB

                                                                                                                                                                                                                                                                                  • memory/2956-268-0x0000000007140000-0x00000000071A6000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    408KB

                                                                                                                                                                                                                                                                                  • memory/2956-168-0x0000000006C10000-0x0000000006C2E000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                                                                                  • memory/2956-294-0x0000000007E80000-0x0000000008042000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.8MB

                                                                                                                                                                                                                                                                                  • memory/2956-187-0x0000000006FF0000-0x000000000703C000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                  • memory/2956-179-0x0000000007390000-0x00000000079A8000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    6.1MB

                                                                                                                                                                                                                                                                                  • memory/2956-185-0x0000000006E20000-0x0000000006E32000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    72KB

                                                                                                                                                                                                                                                                                  • memory/2956-109-0x0000000000E10000-0x0000000000E62000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    328KB

                                                                                                                                                                                                                                                                                  • memory/2956-295-0x0000000008580000-0x0000000008AAC000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    5.2MB

                                                                                                                                                                                                                                                                                  • memory/2956-123-0x0000000005990000-0x000000000599A000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                                                                                  • memory/2956-186-0x0000000006E80000-0x0000000006EBC000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    240KB

                                                                                                                                                                                                                                                                                  • memory/2956-113-0x00000000057E0000-0x0000000005872000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                  • memory/2956-146-0x00000000062E0000-0x0000000006356000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    472KB

                                                                                                                                                                                                                                                                                  • memory/2956-112-0x0000000005CB0000-0x0000000006256000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    5.6MB

                                                                                                                                                                                                                                                                                  • memory/2956-184-0x0000000006EE0000-0x0000000006FEA000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                                                                                  • memory/2992-426-0x0000000140000000-0x000000014159C000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    21.6MB

                                                                                                                                                                                                                                                                                  • memory/2992-384-0x0000000140000000-0x000000014159C000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    21.6MB

                                                                                                                                                                                                                                                                                  • memory/2992-215-0x0000000000400000-0x0000000000459000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    356KB

                                                                                                                                                                                                                                                                                  • memory/2992-382-0x0000000140000000-0x000000014159C000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    21.6MB

                                                                                                                                                                                                                                                                                  • memory/2992-383-0x0000000140000000-0x000000014159C000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    21.6MB

                                                                                                                                                                                                                                                                                  • memory/2992-385-0x0000000140000000-0x000000014159C000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    21.6MB

                                                                                                                                                                                                                                                                                  • memory/2992-217-0x0000000000400000-0x0000000000459000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    356KB

                                                                                                                                                                                                                                                                                  • memory/2992-386-0x0000000140000000-0x000000014159C000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    21.6MB

                                                                                                                                                                                                                                                                                  • memory/3060-415-0x00000000007A0000-0x0000000000C57000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/3060-563-0x00000000007A0000-0x0000000000C57000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/3060-429-0x00000000007A0000-0x0000000000C57000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/3060-53-0x00000000007A0000-0x0000000000C57000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/3060-458-0x00000000007A0000-0x0000000000C57000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/3060-237-0x00000000007A0000-0x0000000000C57000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/3060-558-0x00000000007A0000-0x0000000000C57000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/3060-508-0x00000000007A0000-0x0000000000C57000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/3060-369-0x00000000007A0000-0x0000000000C57000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/3104-3-0x0000000000750000-0x0000000000C02000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/3104-15-0x0000000000750000-0x0000000000C02000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/3104-0-0x0000000000750000-0x0000000000C02000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/3104-5-0x0000000000750000-0x0000000000C02000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/3104-2-0x0000000000751000-0x000000000077F000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    184KB

                                                                                                                                                                                                                                                                                  • memory/3104-1-0x0000000077436000-0x0000000077438000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                  • memory/3208-494-0x0000000006160000-0x00000000061AC000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                  • memory/3288-572-0x0000000004520000-0x0000000004877000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                                                                                  • memory/3288-574-0x0000000004F80000-0x0000000004FCC000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                  • memory/3776-605-0x0000000004C00000-0x0000000004F57000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                                                                                  • memory/3776-621-0x00000000052B0000-0x00000000052FC000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                  • memory/3892-197-0x0000000000CC0000-0x0000000000CC1000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/3932-548-0x0000023CAF560000-0x0000023CAF56A000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                                                                                  • memory/3932-547-0x0000023CAF570000-0x0000023CAF582000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    72KB

                                                                                                                                                                                                                                                                                  • memory/3932-407-0x0000023C94270000-0x0000023C94EC2000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    12.3MB

                                                                                                                                                                                                                                                                                  • memory/4008-290-0x000000001E7C0000-0x000000001E982000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.8MB

                                                                                                                                                                                                                                                                                  • memory/4008-249-0x000000001DB90000-0x000000001DBCC000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    240KB

                                                                                                                                                                                                                                                                                  • memory/4008-163-0x00000000009E0000-0x0000000000A4C000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    432KB

                                                                                                                                                                                                                                                                                  • memory/4008-247-0x000000001DC60000-0x000000001DD6A000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                                                                                  • memory/4008-291-0x000000001EEC0000-0x000000001F3E8000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    5.2MB

                                                                                                                                                                                                                                                                                  • memory/4008-248-0x000000001C760000-0x000000001C772000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    72KB

                                                                                                                                                                                                                                                                                  • memory/4008-285-0x000000001E170000-0x000000001E1E6000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    472KB

                                                                                                                                                                                                                                                                                  • memory/4008-286-0x000000001C740000-0x000000001C75E000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                                                                                  • memory/4032-418-0x00000000003A0000-0x0000000000852000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/4032-423-0x00000000003A0000-0x0000000000852000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4.7MB

                                                                                                                                                                                                                                                                                  • memory/4064-115-0x0000000000870000-0x00000000008C2000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    328KB

                                                                                                                                                                                                                                                                                  • memory/4064-368-0x0000000007CB0000-0x0000000007D00000-memory.dmp
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    320KB